Act
active
Tensorlake npm SDK v0.5.144 Compromised with Credential-Stealing Worm
- Engineer — Act: Confirmed supply-chain compromise: audit package-lock.json and yarn.lock across all repos for tensorlake@0.5.144, remove immediately if found, and rotate any credentials or secrets accessible during builds on affected systems.
- SOC/IR — Act: Active worm establishes persistence and phones home for remote code execution — sweep CI/CD runners and developer workstations that may have installed this version for anomalous outbound connections and new persistence artifacts since the package was published.
- Leader — Plan: Niche but confirmed supply-chain compromise with credential exfiltration; direct engineering to audit dependency manifests for tensorlake SDK usage this week and escalate to incident response if any instances are found.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.