Incident database

Tensorlake npm Package Compromised with Shai-Hulud Credential-Stealing Worm

A malicious version (0.5.144) of the Tensorlake npm package, a TypeScript SDK for Tensorlake's AI agent/document processing services, was compromised in a ChainDrop/Shai-Hulud supply chain attack. The package contained obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.

Disclosed 8 October 2026 · Record updated 8 October 2026

Our coverage

Incidents

Malicious build of Tensorlake npm package carries credential stealer

Version 0.5.144 of the TypeScript SDK was compromised in a ChainDrop/Shai-Hulud supply chain attack that harvests secrets and runs remote code, Socket said.

8 Oct 2026