The ‘tensorlake’ npm package, a TypeScript SDK, was compromised in a ChainDrop / Shai-Hulud supply chain attack. Malicious version 0.5.144 contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code. This incident underscores the severe risks of supply chain attacks targeting popular software development packages. Developers are urged to verify the integrity of their dependencies.