{"id":"MAL-2026-17650","url":"https://compromised.live/t/MAL-2026-17650","kind":"compromised_package","tier":1,"severity":"critical","title":"Malicious code in tensorlake (npm)","summary":"Attackers have published malicious code inside this package, which can run harmful commands on any machine that installs it and may steal secrets or credentials. The npm package tensorlake, version 0.5.144. Remove or downgrade tensorlake 0.5.144 now, rotate any credentials on affected machines, and check for signs of compromise.","summary_source":"ai","affected":[{"ecosystem":"npm","package":"tensorlake","affected":"0.5.144","fixed":[]}],"epss":null,"kev":null,"first_seen":"2026-11-03T21:55:44.095Z","updated_at":"2026-11-03T21:55:44.095Z","status":"active","details":"","aliases":["GHSA-rqxj-g25x-4v9v","MAL-2026-17650"],"sources":[{"name":"osv","id":"MAL-2026-17650","url":"https://osv.dev/vulnerability/MAL-2026-17650"}]}