organization · DiggingBeagle record
StepSecurity
Independent software supply-chain investigator of the Tensorlake signed-malware release.
- Entity kind
- organization
Record description
StepSecurity analyzed the Tensorlake 0.5.144 incident, tracing malicious changes through the legitimate npm provenance chain and documenting install-time credential theft, Claude Code and VS Code configuration poisoning, and a destructive GitHub token revocation monitor.