advisory-catalog: tensorlake-2026-10-08

threat_intel/README.md

@@ -12,6 +12,7 @@ the entries against current advisories before production use.
 
 | File | Campaign | Source |
 |---|---|---|
+| [`tensorlake-2026-10-08.json`](tensorlake-2026-10-08.json) | ChainDrop / Shai-Hulud npm supply-chain compromise of `tensorlake` (1 malicious version, 0.5.144, published 2026-10-08; `preinstall` hook runs obfuscated `lib/setup.mjs` loader and `lib/Math_Symbol.js` credential-stealing, self-propagating worm payload) | [Socket, 2026-10-08](https://socket.dev/blog/tensorlake-compromise) |
 | [`memtensor-2026-09-23.json`](memtensor-2026-09-23.json) | MemTensor npm and PyPI credential-stealer compromise (2 packages / 4 malicious versions) | [Socket, 2026-09-23](https://socket.dev/blog/memtensor-compromise) |
 | [`openapi-react-query-codegen-2026-08-28.json`](openapi-react-query-codegen-2026-08-28.json) | Mini Shai-Hulud npm supply-chain compromise of `@7nohe/openapi-react-query-codegen` (10 malicious versions published 2026-08-28 across every maintained release line via a comment-triggered GitHub Actions publishing workflow; obfuscated `binding.gyp`/`preinstall` loader targets cloud, npm, GitHub Actions, and AI agent secrets with self-propagation) | [Socket, 2026-08-28](https://socket.dev/blog/openapi-react-query-codegen-npm-compromise) |
 | [`mastra-2026-06-17.json`](mastra-2026-06-17.json) | Mastra npm supply-chain compromise (141 packages / 141 versions across `@mastra/*` plus `create-mastra` and the `easy-day-js@1.11.22` typosquat dependency that delivered a cross-platform infostealer via postinstall) | [Socket, 2026-06-17](https://socket.dev/blog/mastra-npm-packages-compromised) |

threat_intel/tensorlake-2026-10-08.json

@@ -0,0 +1,21 @@
+{
+  "schema_version": "0.2.0",
+  "_comment": "ChainDrop / Shai-Hulud npm supply-chain compromise of tensorlake, the npm SDK for Tensorlake's AI agent sandbox infrastructure, reported by Socket on 2026-10-08. Malicious version 0.5.144 was published 2026-10-08T01:12:07Z and adds a preinstall hook (node lib/setup.mjs) that launches an obfuscated loader via Bun to run lib/Math_Symbol.js, a credential-stealing, self-propagating worm payload targeting npm, GitHub, AWS, HashiCorp Vault, Kubernetes, SSH, .env, wallet, and AI-tool (.claude, .cursor, .kiro, Windsurf, Zed) secrets, with an Ethereum-contract C2 resolver and a gh-token-monitor dead-man switch. The version was subsequently removed from npm: the packument retains its 2026-10-08T01:12:07.320Z publication timestamp but no longer exposes version metadata (dist-tag latest is 0.5.143). Corroborated by OSV MAL-2026-17650 and GHSA-rqxj-g25x-4v9v (both published 2026-10-08T02:54:39Z), which enumerate 0.5.144 as the affected version.",
+  "entries": [
+    {
+      "id": "socket-2026-10-08-npm-tensorlake",
+      "name": "tensorlake (ChainDrop / Shai-Hulud October 2026 compromise)",
+      "ecosystem": "npm",
+      "package": "tensorlake",
+      "versions": [
+        "0.5.144"
+      ],
+      "severity": "critical",
+      "source": "https://socket.dev/blog/tensorlake-compromise",
+      "references": [
+        "https://osv.dev/vulnerability/MAL-2026-17650",
+        "https://github.com/advisories/GHSA-rqxj-g25x-4v9v"
+      ]
+    }
+  ]
+}