{
  "id": 13069813,
  "title": "Shai-Hulud Just Infected an AI Agent Platform's npm Package — What Self-Hosted n8n Builders Must Do Now",
  "url": "https://urgent.news/2026/10/09/shai-hulud-just-infected-an-ai-agent-platforms-npm-package-what-self",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-09T08:30:03.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cortexflow_tech/shai-hulud-just-infected-an-ai-agent-platforms-npm-package-what-self-hosted-n8n-builders-must-do-kbg"
  },
  "original_language": "en",
  "account": null,
  "summary": "On October 8, 2026, the npm package tensorlake — the TypeScript SDK for Tensorlake's AI agent infrastructure — was compromised by a new Shai-Hulud worm variant. Version 0.5.144 shipped a preinstall hook that stole npm tokens, GitHub tokens, AWS keys, SSH keys, .env files, crypto wallets, and browser passwords from every machine that installed it. The version was pulled within minutes, but the…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}