Software Security > Tensorlake npm package

Tracking since May 19, 2026 · Latest signal Oct 9, 2026 · 3 matched data points

Overall sentiment

Positive 0% (0)Negative 100% (3)Neutral 0% (0)

Daily sentiment

Claims (1)

Claims contributing to this aggregate. Confirmed negative claims count as negative impact; confirmed positive claims count as positive impact.

The Tensorlake npm package was compromised in a ChainDrop/Shai-Hulud attack, allowing the distribution of a credential-stealing worm.

Parent: Software SecurityEntity: Tensorlake npm packageImpact: negativeDate: Oct 8, 2026 - Oct 9, 2026Target: The security of the Tensorlake npm package3 matched entries3 confirmed0 disputed0 neutral0 unclear