
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@sentry/conventions
Advanced tools
<source srcset="https://sentry-brand.storage.googleapis.com/sentry-logo-white.png" media="(prefers-color-scheme: dark)" /> <sour
The package exports:
attributes: contains constants for all attribute names and their types, as defined in the Sentry semantic conventionsattributes.ATTRIBUTE_METADATA: provides metadata about attributes, such as their type, scrubbing definition, deprecation info, and lookup keys@sentry/conventions/attributes/search: contains constants and metadata for the names exposed in Sentry searchattributes.Attributes: represents a bag of typed attributesop: contains constants for span operations used in SentryAn attribute's value may be readable under several keys: its own, the names Sentry search exposes it as, and the deprecated attributes it replaces. ATTRIBUTE_METADATA[key].keys lists all of them, most preferred first:
import { ATTRIBUTE_METADATA, HTTP_METHOD } from '@sentry/conventions/attributes';
ATTRIBUTE_METADATA[HTTP_METHOD].keys;
// ['http.request.method', 'http.method', 'http.request_method', 'method']
The order within a chain is:
Deprecated attributes are only added to a chain if their status is normalize or backfill.
If an attribute is deprecated with another status or status null, it's own keys array will not contain any
replacing attribute. Therefore, there's no guarantee for a stable attribute in a key chain.
FAQs
<source srcset="https://sentry-brand.storage.googleapis.com/sentry-logo-white.png" media="(prefers-color-scheme: dark)" /> <sour
The npm package @sentry/conventions receives a total of 14,706,112 weekly downloads. As such, @sentry/conventions popularity was classified as popular.
We found that @sentry/conventions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.