Skip to content
Threat Feed
Subscribe

Product

Tensorlake (0.5.144)

1 brief RSS
high advisory

Malicious TensorLake npm SDK Hijacks Developer Environments

A malicious npm release of the TensorLake TypeScript SDK (v0.5.144) uses a preinstall hook to exfiltrate developer credentials and AI-tool configurations while maintaining remote command execution capabilities.

tensorlake +2 supply-chain npm credential-theft javascript
1r 2t