Live and recent posts from across the Fediverse tagged #shaihulud, aggregated by home.social.
Aikido reports that Tensorlake version 0.5.144, published on October 8, is malicious.
It runs during installation, before the package is used, and tries to steal access credentials and spread to other projects.
Aikido links it to a new Shai-Hulud variant.
The package has more than 100,000 installs overall, but that is not the install count for this specific version.
Aikido says its analysis found no signs of compromise…
Tensorlake package version 0.5.144 contained Shai-Hulud, a malicious program designed to collect access credentials and publish infected versions of other packages the user’s account could access.
Socket says it searched files and systems used by developers and companies for sensitive information.
The release is no longer available, and those who installed it are urged to remove it and change access details that may ha…