Malicious code in tensorlake (npm)

What's happening and what to do

Attackers have published malicious code inside this package, which can run harmful commands on any machine that installs it and may steal secrets or credentials. The npm package tensorlake, version 0.5.144. Remove or downgrade tensorlake 0.5.144 now, rotate any credentials on affected machines, and check for signs of compromise.