Hijacked TensorLake npm Turned Install Into Credential Risk
From the source: Sonatype Blog
TL;DR A malicious release of TensorLake's TypeScript SDK, tensorlake@0.5.144 , used an install hook to search for developer credentials and accept remote commands. Sonatype's code review found that its GitHub fallback could create a public repository and commit collected data, including a stolen GitHub token in one path, and that the malware could modify accessible repositories by committing…
Read the full story on Sonatype BlogAsk the square
The story is what was announced. If it raises a question for your team, ask the people who run this technology day to day. Your post links back to this story, so the next reader finds it too.
Recent threads in DevOps & Platform Engineering
How are you measuring platform engineering success?
DORA metrics, developer surveys, time-to-first-deploy, cost per service? What convinced leadership the platform team is worth it?
What is in your internal developer platform, and what did developers actually adopt?
Golden paths, templates, portals, self-service environments. Which parts get used every day and which became shelfware?
Something wrong or out of date? Suggest a correction. We reply within 5 business days.
More from Sonatype
Recent updates from Sonatype, so you can tell whether this is a one-off or part of a pattern.
More in DevOps & Platform Engineering
What other companies in DevOps & Platform Engineering are doing. The category page shows who’s active, side by side.
