Veille cybersecurite : Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Source : The Hacker News
The npm package known as « tensorlake, » a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.
The malicious version 0.5.144 « contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code, » Socket said
Vous vous demandez si votre entreprise est exposee a ce type de faille ? Reservez un appel decouverte gratuit.