Hackers hijack Tensorlake npm package to spread credential-stealing worm

A popular developer package was tampered with to deliver the Shai-Hulud worm, which is built to steal login credentials. The report gives no further details on scope or impact.