Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware

A malicious version of the npm package "tensorlake" (v0.5.144) was published with a preinstall hook that downloads Bun to run an obfuscated payload—identified by provided SHA‑256 hashes—that implements a Shai‑Hulud supply‑chain worm capable of stealing environment and browser cryptocurrency credentials, exfiltrating secrets (npm/GitHub/cloud/SSH/CI), and propagating by abusing stolen publishing tokens; the campaign uses the C2 domain iseekaigogo.com and an Ethereum smart contract for fallback, and investigators traced the initial intrusion to a verified maintainer commit in the Tensorlake GitHub repository.