software · DiggingBeagle record
Tensorlake SDK
Software-development platform whose npm tensorlake 0.5.144 release carried malicious install-time code.
- Entity kind
- software
Record description
Tensorlake maintains open-source SDKs and release automation. On October 8, 2026 a malicious npm release was traced to commits on the real repository main branch and a manually dispatched legitimate publishing workflow. Maintainers merged a rollback and release-approval hardening in PR #1016; execution of the cleanup tasks listed in that PR requires separate verification.