Where is the fbi in this? Why has no one been arrested? This is a massive crime.
Keyv and friends compromised in active Shai-Hulud supply chain attack
101–110 of 145 posts
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#102Earlier quoted context omitted.
I think that's barely meaningful. Which of the compromised packages would have been part of any reasonable stdlib?
It’s not that there’s a single stdlib feature which would’ve stopped this but more that JavaScript developers have been conditioned that it’s normal to install tons of packages and update them quite frequently so there are a lot of individual maintainers who if compromised have a surprising impact. You’re exposed as a function of the number of dependencies so the communities which most normalize many rapidly updating…
I just don't think that this is that unique to javascript, it's absolutely not about npm, and I don't think that this is well supported as a relevant feature that leads to these attacks.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#103Earlier quoted context omitted.
Yeah, my point is just that other package managers aren't in a great spot. NPM even lets you separate out "publish" and "release" now where you can publish to the registry but you have to separately "ack" that to release. That's kinda a huge win if people use it. I just think the framing that npm is so bad is really flatly invalid.
> the framing that npm is so bad is really flatly invalid. Is it really though if we're getting thousands of compromised packages regularly? You can do all the right things and still be legit problematic.
Yes, it has nothing to do with the design of npm (relative to similar languages/ repositories) and everything to do with the popularity.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#104Earlier quoted context omitted.
This is the most boring comment posted on every one of these. NPM is by no means the worst offender here and offers a ton of solutions to this, lots of package managers are behind it or equivalent. NPM gets targeted a lot because it's popular. That's it.
left-pad was over a decade ago. it's a problem with the registry itself, more than just the package manager.
left-pad is totally irrelevant to this conversation.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#105Earlier quoted context omitted.
That would be extremely surprising, given the number and severity of federal crimes involved. (I also dare say: many of these attackers demonstrate a better in-depth understanding of packaging ecosystems than supply chain security vendors do.)
the federal crimes part is irrelevant if its below the threshold of federal authorities actually cracking down on them and figuring out entire chain. just because credit card theft and other types of scam are illegal I remember how ddos attackers created "DDOS protection" companies to protect their victims against DDOS.
I don’t think the impact of these recent malware campaigns is below the threshold for federal interest.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#106I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous. Surely Github's software is good enough that an intern can slop the 80/20 together in a day? It would be an actually good use of AI spending…
GitHub announced this a while back: https://github.blog/changelog/2026-07-28-npm-publish-time-ma...
Ah, I see your problem there
> This requirement will be progressively enforced over time.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#107Oh boy, it's a big one.
> Oh boy, it's a big one. Yup the "Update" in TFA is scary: "Update — August 4, 2026, 13:37 CEST: At least 434 packages (across 1381 versions) have been compromised by the worm, with a combined total of over 2 billion monthly installs at the time of writing. " Lots of pain ahead.
2,523 and counting
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#108Where is the fbi in this? Why has no one been arrested? This is a massive crime.
I'm guessing (though not sure) the actors are outside the US.
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#109Earlier quoted context omitted.
Nobody is claiming this is a complete solution to security. I would call this "necessary but not sufficient". You won't get far as an engineer if you refuse to implement "necessary but not sufficient" changes because the change doesn't in and of itself one-shot the entire problem.
These half-measures is why everything has gone to shits. Instead of properly auditing software, reducing the quantity and increasing the quality, we keep pushing more and more garbage where all you find is 2FA that, captcha this, not supported this, app not signed, etc..
Can't agree more. I'm working on OSS security tool that can protect you from Shai-hulud, no half measures.
The idea is to have a local proxy that injects real secrets into requests in-flight, so a compromised library has nothing to steal because it never had access to any of your secrets: https://github.com/inflightsec/agent-vault-proxy
Re: Keyv and friends compromised in active Shai-Hulud supply chain attack
#110what commercial tools are enterprises using today to defend against such attacks? Do they really work? I mean, do they report/block malware after the fact or detect proactively. Because if the latter then, package registries should really be removing reported packages, right?