Compromised “tensorlake” npm Package Delivers Credential‑Stealing Worm via Supply‑Chain Attack
What Happened — The npm package tensorlake (a TypeScript SDK for Tensorlake applications) was published with a malicious version 0.5.144. The package contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous third‑party risk monitoring and evidence‑based assurance that external components remain untampered.
- Demonstrates how a supply‑chain breach can bypass traditional perimeter controls, making robust vendor‑oversight processes essential for audit readiness.
- Provides a concrete example of why organizations should maintain an up‑to‑date software bill of materials (SBOM) and enforce package‑signing verification.
Who Is Affected — Developers and DevOps teams that integrate the Tensorlake SDK, cloud service providers offering Tensorlake‑based workloads, and any SaaS vendors that rely on the compromised npm package.
Recommended Actions —
- Generate an SBOM for all production dependencies and verify package signatures against trusted sources.
- Remove the compromised version 0.5.144 immediately and replace it with a clean release.
- Deploy automated monitoring of npm registry changes and alert on unexpected version updates.
- Conduct a focused vendor risk assessment of the Tensorlake SDK provider, documenting controls and evidence in your continuous assurance platform.
Technical Notes — The malicious payload is delivered via the npm package version 0.5.144; it performs credential harvesting, secret exfiltration, persistence establishment, and remote code execution. No CVE has been assigned; the incident is classified as a supply‑chain compromise. Source: The Hacker News