Shai-Hulud - f4n6

notes

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

1. Executive summary The npm package tensorlake, a TypeScript SDK for Tensorlake applications, sandboxes and cloud services, was published in a malicious version 0.5.144

08 Oct 2026 · 10 min read read →

notes

Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data

1. Executive summary Threat actors copied approximately 170 of CrowdSec's private GitHub repositories on 22 May 2026, using the GitHub account of a recently

22 Sep 2026 · 6 min read read →

notes

Shai-Hulud's Reach Just Grew to 469 Credential Locations. Here's What That Means

1. Executive summary GitGuardian researchers report that a recent variant of the Shai-Hulud infostealer worm has expanded its credential-scanning behaviour from 189 to 469

03 Sep 2026 · 6 min read read →