Evidence · DiggingBeagle record
Tensorlake maintainer: revert malicious 0.5.144 and harden npm release path
Merged October 8 maintainer PR traces unauthorized main-branch commits and manual signed publishing; records reverted commits, CI install-script controls, new approvals, npm takedown and still-open cleanup tasks.
- Published
- Oct 8, 2026
- Publisher
- Tensorlake maintainers
- Source role
- patch commit artifact
Evidence record
Merged October 8 maintainer PR traces unauthorized main-branch commits and manual signed publishing; records reverted commits, CI install-script controls, new approvals, npm takedown and still-open cleanup tasks.
Claim-level citations (1)
- supportsA compromised Tensorlake release used valid npm provenance to deliver a credential-stealing worm: Tensorlake maintainer PR #1016 was merged October 8 and reverted malicious main-branch changes, disabled npm lifecycle scripts in CI installs, added a package-manifest tripwire and strengthened publishing review; at the time of the PR, account locking, credential rotation and six native-package takedowns were still listed as human tasks.
Incident; This PR; Repo settings already changed; Still to do by a human