TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack

Socket detected a compromised release of tensorlake, the npm SDK for Tensorlake’s AI agent infrastructure, in a ChainDrop / Shai-Hulud supply chain attack. Version 0.5.144 contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code. The package receives approximately 12K weekly downloads and has over 1k stars on GitHub. Tensorlake provides isolated sandboxes for running untrusted, LLM-generated code, with…