Tensorlake SDK 0.5.144 ran a worm on install that stole npm, GitHub, and cloud credentials along with AI coding tool configs. Learn how to check your lockfiles, which credentials to rotate, and how Cloudsmith policies stop releases like this from reaching your builds.
Tensorlake SDK npm package compromised
calendar_today
October 9, 2026
domain
cloudsmith