npm · disclosed 8 October 2026

Tensorlake npm SDK compromised with a self-spreading worm

Version 0.5.144 ran a preinstall worm that steals npm, GitHub and cloud tokens and spreads to other packages the victim can publish.

Detectable by a website scanNo, server-side only
Last reviewed23 October 2026

Affected packages

Package	Affected versions
`tensorlake`	0.5.144

What to do

Server and developer machines only. If installed, rotate npm, GitHub and cloud tokens.

Sources

StepSecurity: Tensorlake npm package compromised
Socket: TensorLake npm SDK compromised

We update this page as new information is published. Package versions are also checked live against OSV.dev during every audit, so newly flagged versions are caught even before this page changes.