Supply-chain attacksBriefConfirmed by two or more outlets
tensorlake npm 0.5.144
A worm (ChainDrop / Shai-Hulud lineage, possibly covered) that wipes the host if its token is revoked.
- Disclosed
What happened
- A worm (ChainDrop / Shai-Hulud lineage, possibly covered) that wipes the host if its token is revoked. It also targeted AI tool configuration files.
Sources
- https://www.aikido.dev/blog/tensorlake-npm-package-compromised
- https://www.scworld.com/brief/tensorlake-npm-package-compromised-in-supply-chain-attack
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.