TENSORLAKE NPM PACKAGE COMPROMISED: A WORM WITH A HOSTAGE TOKEN THAT WIPES YOUR MACHINE IF YOU REVOKE IT

Summary from the TLDR InfoSec newsletter

tensorlake@0.5.144 on npm steals developer credentials at install and plants a gh-token-monitor service that wipes the home directory if the stolen GitHub token is revoked. The release was built from malicious commits pushed straight to the project's main branch under a maintainer's name, StepSecurity found, so it carries a valid npm provenance attestation while spreading through victims' npm packages and repos. Pin to 0.5.143, remove the service under ~/.config/gh-token-monitor/ before revoking any token, then rotate every credential the machine held.