Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

A malicious release (v0.5.144) of the npm package 'tensorlake' was published in a supply-chain attack attributed to ChainDrop/Shai-Hulud; the release contains an obfuscated Bun-based worm that harvests npm/GitHub/AWS/HashiCorp/Kubernetes/SSH/.env/cryptocurrency/messaging/AI-agent secrets, drops HackBrowserData, establishes persistence, and exfiltrates data via iseekaigogo.com, an Ethereum-based resolver, or staged GitHub repositories while also attempting to propagate by republishing compromised packages and planting workflows; affected users are advised to remove the package and rotate credentials.