Evidence · DiggingBeagle record
GitHub Advisory GHSA-rqxj-g25x-4v9v: malware in tensorlake 0.5.144
Security advisory explicitly identifies npm tensorlake version 0.5.144 as malware and urges fully compromised host treatment; its no-patched-version field describes the malicious version and is not proof that later clean releases are absent.
- Published
- Oct 8, 2026
- Publisher
- GitHub Advisory Database
- Source role
- secondary reporting
Evidence record
Security advisory explicitly identifies npm tensorlake version 0.5.144 as malware and urges fully compromised host treatment; its no-patched-version field describes the malicious version and is not proof that later clean releases are absent.
Claim-level citations (1)
- supportsA compromised Tensorlake release used valid npm provenance to deliver a credential-stealing worm: The GitHub Advisory Database marked exactly npm tensorlake 0.5.144 as malware and advised treating systems that installed it as fully compromised; the advisory lists no patched version for that malware entry.
Affected versions; Patched versions; Description