Security News Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm TheHackerNews Daniel Bender 08 Oct 2026 Share Malicious tensorlake npm version 0.5.144 contained a Shai-Hulud worm that harvests credentials and can republish compromised packages.
