Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

Security news roundup covering active exploitation, critical vulnerabilities, malware campaigns, and supply-chain compromises. Key incidents include a compromised Tensorlake npm package delivering the Shai-Hulud credential-stealing worm, malicious npm packages distributing RATs and stealers, critical unauthenticated RCE in LMCache, CVSS 10 pre-authentication SSRF in SonicWall SMA1000, active exploitation of Atlassian Data Center CVE-2026-21589, FortiBleed credential harvesting, and malware targeting exposed AI infrastructure for cryptomining.