Tensorlake npm package contains worm that steals credentials and locks data

2026-10-08

A worm discovered in the tensorlake npm package version 0.5.144 steals developer credentials and spreads to other repositories. It also installs a hostage token that erases the user's home directory if the compromised GitHub token is revoked. StepSecurity identified the threat and notified the package maintainers.