Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise

The Shai-Hulud credential-stealing worm was found in Tensorlake's npm SDK release 0.5.144, enabling theft of wallets, browser and cloud credentials, GitHub secrets, and self-propagation; the malicious package was flagged and removed 11 minutes after publication, but users and build systems should verify they did not install the compromised version and rebuild affected hosts before restoring secrets.