Version 0.5.144 of the npm package tensorlake was published from a compromised maintainer identity and contains embedded malicious code. The payload harvests developer credentials, including GitHub and npm tokens, cloud keys, Kubernetes and Vault secrets, SSH keys, saved browser logins and AI-tool configuration files, then republishes the victim's own npm packages with the payload added and installs a service that deletes the user's home directory if the stolen GitHub token is revoked. Version 0.5.143 is not affected.