Supply-chain compromise affecting an organization (Software Development)

The npm package tensorlake, a TypeScript SDK for Tensorlake applications, was compromised in a supply chain attack. Malicious version 0.5.144 was deployed containing obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code.

Sources

• Primary source on file. It names the organization, so it is not linked while this entry is anonymized.
• Upstream: Security news (RSS + Claude). The upstream record names the organization, so it is not linked here.
• Candidate incidents extracted from public security reporting; every entry links its article