Tensorlake npm preinstall spawning download or obfuscated JS (Shai-Hulud)

ills3c Intel&Coffee@Ills3C

•updated 5 days ago•1•0•12

Detects the Tensorlake npm 0.5.144 compromise (Shai-Hulud worm via preinstall). Includes a baseline query to identify the affected package/version across Defender inventory, file, network, device and process events, plus preinstall download/obfuscated-exec behaviour. Results are summarized per device/account.