socket.devwriteupTensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Socket.dev reports that TensorLake's npm SDK was compromised as part of the ChainDrop campaign, a variant/wave of the Shai-Hulud credential-stealing npm worm. The compromised package reportedly harvests developer credentials from infected systems, continuing the pattern of self-propagating npm supply-chain attacks seen across the Shai-Hulud family. Full technical detail could not be verified in this pass due to a content-processing failure.
TL;DR Socket reports TensorLake's npm SDK was hit by the ChainDrop wave of the Shai-Hulud credential-stealing npm worm.
Organisations named here
- Shai-Hulud
Technologies named here
- npm
- Socket
- tensorlake
Threat actors named here
- ChainDrop
Related in Supply Chain
