Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The tensorlake npm package was poisoned in a classic open-source supply chain attack, injecting a self-replicating worm (Shai-Hulud) that steals credentials, establishes persistence, and executes remote code on victim machines. What makes this attack particularly dangerous is the worm's ability to re-publish itself to npm, amplifying the blast radius far beyond the initial compromise. The use of an Ethereum smart contract for command-and-control (C2) communication is a novel evasion technique that makes traditional domain-based blocking ineffective. This incident underscores the implicit trust developers place in third-party packages and the catastrophic consequences when that trust is exploited.