11–20 of 145 posts
aikido.dev: SAST, AI code analysis and therefore a website that uses 100% CPU and prevents scrolling. To the point of the article: I don't know why GitHub still allows the release feature. It is complete insanity. Tar archives must be constructed manually and checked for leaked keys etc.
I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous. Surely Github's software is good enough that an intern can slop the 80/20 together in a day? It would be an actually good use of AI spending…
https://github.blog/changelog/2026-07-28-npm-publish-time-ma...
At this point, any package adding a pre-install hook where there previously was not one should be denied and treated with extreme suspicion. It's time pre-install / post-install hooks were killed off. Start with a moratorium on any new ones.
At this point, any package adding a pre-install hook where there previously was not one should be denied and treated with extreme suspicion. It's time pre-install / post-install hooks were killed off. Start with a moratorium on any new ones.
1. Audit build scripts/ proc macros for rust code (and mark with cargo-vet).
2. Have an isolated workflow for "build/test/push artifact to temporary place" (s3, github artifact, whatever). No API keys in this workflow.
3. Have another workflow that has the API keys to publish that grabs the artifact and then places it into a registry.
This creates clear separation of "code runs here" and "environment has privileges".
In my own slop-driven programming language I have build scripts declare their capabilities upfront so that you can statically reason about them (same with runtime permissions).
At this point, any package adding a pre-install hook where there previously was not one should be denied and treated with extreme suspicion. It's time pre-install / post-install hooks were killed off. Start with a moratorium on any new ones.
yeah but they can just put the dropper, etc in index.js, so that it runs at import time rather than at install time, no? i guess first-install time is often a privileged developer machine, and will execute in a "server"-like runtime such as Node, Bun, Deno. but blocking preinstall scripts is basic first aid...
Does anyone happen to have a grep or similar that helps me check if this is showing up anywhere in the trillions of files in node_modules (or pnpm store)?
For example:
find . -type f | grep -P "/Math_Symbol\.js$"Does anyone happen to have a grep or similar that helps me check if this is showing up anywhere in the trillions of files in node_modules (or pnpm store)?
Earlier quoted context omitted.
yeah but they can just put the dropper, etc in index.js, so that it runs at import time rather than at install time, no? i guess first-install time is often a privileged developer machine, and will execute in a "server"-like runtime such as Node, Bun, Deno. but blocking preinstall scripts is basic first aid...
Nobody is claiming this is a complete solution to security. I would call this "necessary but not sufficient". You won't get far as an engineer if you refuse to implement "necessary but not sufficient" changes because the change doesn't in and of itself one-shot the entire problem.