Skip to content
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

Ravie LakshmananOct 08, 2026Artificial Intelligence / Cloud Security The npm package known as “tensorlake,” a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop /… 

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Attackers compromised three country-code top-level domains (ccTLDs) and obtained unauthorized HTTPS certificates for several Google domains, Google said on October 6. Google’s own systems were not breached, but any domain ending in .gh (Ghana), .sl (Sierra… 

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer

Ravie LakshmananOct 07, 2026Supply Chain / Malware Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts. The campaign has…