🎯 Browser extension data theft

The items that name it 2

• tensorlake NPM package compromised with Shai Hulud worm
  writeup2026-10-08It is written here as Browser extension data theft (cryptocurrency wallets).

  Malware reads hardcoded file paths for 14 cryptocurrency browser extensions and exfiltrates IndexedDB and LevelDB files; new behavior vs prior Shai-Hulud waves.

• Mastra Attack Targets Crypto, Password Managers, Authenticators, and Zapier
  writeup2026-06-18

  Checks Local Extension Settings across Chrome/Brave/Edge profiles against a base64-encoded list of 166 target extension IDs (crypto wallets, password managers, MFA tools, Zapier) and exfiltrates matching extension data