Tensorlake npm package implanted with Shai-Hulud credential-stealing worm

Tensorlake's TypeScript SDK npm package tensorlake suffered a ChainDrop / Shai-Hulud supply chain attack; the malicious version 0.5.144 has been taken down. This version uses a preinstall hook to launch an obfuscated loader that executes a credential-stealing and self-propagating worm in the Bun runtime, collecting local files, CI environments, and credentials in Kubernetes and Vault, and dropping HackBrowserData binaries, exfiltrating data, and establishing persistence on the host. Stolen data includes npm and GitHub tokens, AWS credentials, SSH keys, .env files, cryptocurrency wallets, and configuration and MCP files related to Anthropic Claude, Cursor, Kiro, Windsurf, and Zed. Users who have installed this version are advised to remove it immediately and rotate credentials.