Shai-Hulud worm reaches AI infrastructure: Tensorlake npm SDK compromised
The Shai-Hulud npm worm has now reached AI infrastructure. On October 8, tensorlake@0.5.144, the npm SDK for Tensorlake’s platform for running AI agents and untrusted AI-generated code, shipped with the worm’s credential-stealing payload inside. The jump matters because the SDK installs on developer workstations and build runners, outside the sandbox protections the platform itself sells. […]