tensorlake NPM package compromised with Shai Hulud worm

A malicious actor published [email protected] to npm on 8 October 2026 embedding a Shai-Hulud worm variant that executes via a preinstall script, drops a Bun runtime, exfiltrates a wide range of environment variables, credential files and browser extension data, and attempts supply-chain propagation; the malware includes hardcoded C2 (iseekaigogo.com) and a blockchain-based dead-drop for alternate C2, and the repository was briefly compromised prior to the malicious publish.