aiqbench analysis
This incident highlights critical supply chain risks where compromised dependencies in AI agent development environments can exfiltrate secrets and propagate malware across CI/CD systems without user interaction. The compromise of the Tensorlake package, a serverless sandbox for AI agents, underscores the vulnerability of trusted npm registries to credential theft and automated worm propagation. Developers must prioritize rigorous dependency verification and monitor for unauthorized commits in repositories hosting AI infrastructure tools.
Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets
A malicious release of the Tensorlake npm package has been published with a Shai-Hulud worm variant that can steal developer secrets and attempt to spread through connected software supply chains. The affected version, tensorlake@0.5.144, was released on October 8, 2026. Tensorlake is a serverless sandbox platform for AI agents, and its npm package has recorded […] The post Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets appeared first on Cyber Security News.
A malicious release of the Tensorlake npm package has been published with a Shai-Hulud worm variant that can steal developer secrets and attempt to spread through connected software supply chains. The affected version, tensorlake@0.5.144, was released on October 8, 2026. Tensorlake is a serverless sandbox platform for AI agents, and its npm package has recorded more than 100,000 lifetime installs, increasing the potential reach of the incident. Aikido’s technical report says the package’s PyPI and Cargo distributions showed no sign of compromise…
Excerpt shown under the publisher's RSS terms · 82 words · full text and figures are on the publisher's site
Related coverage
Popular npm Package With 150K+ Weekly Downloads Hit by Credential-Stealing Supply-Chain Worm
Cybersecurity News · Aug 31, 2026
Shai-Hulud CHAINDROP Worm Backdoors 400+ npm Packages With 1.3 Billion Monthly Downloads
Cybersecurity News · Aug 7, 2026
Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
Cybersecurity News · Oct 2, 2026
New Shai-Hulud Supply Chain Attack Compromised 400+ Popular npm Packages
Cybersecurity News · Aug 6, 2026