Keyv and friends compromised in active Shai-Hulud supply chain attack
1–10 of 145 posts
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#2I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous.
Surely Github's software is good enough that an intern can slop the 80/20 together in a day? It would be an actually good use of AI spending.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#3> Update — August 4, 2026, 13:37 CEST: At least 868 packages (across 1381 versions) have been compromised by the worm, with a combined total of over 2 billion monthly installs at the time of writing.
This is such lazy or click baiting writing. Who cares how many installations there are per month normally? The high install numbers are almost certainly from running in CI where such secrets don’t exist. How many installs actually occur in a non CI environment and of those how many were the compromised version?
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#4> Update — August 4, 2026, 13:37 CEST: At least 868 packages (across 1381 versions) have been compromised by the worm, with a combined total of over 2 billion monthly installs at the time of writing. This is such lazy or click baiting writing. Who cares how many installations there are per month normally? The high install numbers are almost certainly from running in CI where such secrets don’t exist. How many install…
> almost certainly from running in CI where such secrets don’t exist.
CI usually has the most privileged secrets anywhere in a company lol
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#5At this point, any package adding a pre-install hook where there previously was not one should be denied and treated with extreme suspicion.
It's time pre-install / post-install hooks were killed off. Start with a moratorium on any new ones.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#6> Update — August 4, 2026, 13:37 CEST: At least 868 packages (across 1381 versions) have been compromised by the worm, with a combined total of over 2 billion monthly installs at the time of writing. This is such lazy or click baiting writing. Who cares how many installations there are per month normally? The high install numbers are almost certainly from running in CI where such secrets don’t exist. How many install…
> almost certainly from running in CI where such secrets don’t exist. CI usually has the most privileged secrets anywhere in a company lol
CIs having per-package installs : version ratio > 1 are fundamentally dumb idea in the first place.
In a way, this teaches us that there is something as too much reliability in an ecosystem. Specifically, Github is apparently reliable enough that its occasional outages are insufficient to kill all the companies running these dumb CI setups that redownload packages from the Internet every build - so there's no incentive to reduce waste and improve security globally.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#7At this point, any package adding a pre-install hook where there previously was not one should be denied and treated with extreme suspicion. It's time pre-install / post-install hooks were killed off. Start with a moratorium on any new ones.
iirc does pnpm not allow them by default. But even if we killed them off there would still be a chance of the malware hooking into something else or only working in cli applications.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#8aikido.dev: SAST, AI code analysis and therefore a website that uses 100% CPU and prevents scrolling.
To the point of the article: I don't know why GitHub still allows the release feature. It is complete insanity. Tar archives must be constructed manually and checked for leaked keys etc.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#9Does anyone happen to have a grep or similar that helps me check if this is showing up anywhere in the trillions of files in node_modules (or pnpm store)?
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#10I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous. Surely Github's software is good enough that an intern can slop the 80/20 together in a day? It would be an actually good use of AI spending…
> I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous.
Maybe that's the idea. Regards, the