Keyv and friends compromised in active Shai-Hulud supply chain attack

Post by cute_boi » Wed, Aug 05, 2026, 6:16 PM UTC

wolfi1 wrote: post #23

cute_boi wrote: post #17

I think npm can use chatgpt/claude for each published package to detect these types of attack? And if it sees they can restrict the package from making any changes.

the remedy is worse than the disease

Post by acdha » Wed, Aug 05, 2026, 8:29 PM UTC

insanitybit wrote: post #140

acdha wrote: post #139

Earlier quoted context omitted.

Nobody is saying NPM is unique - it’s one end of a spectrum but that doesn’t mean everything else is completely on the other end - for example, this study found Maven projects having almost as many dependencies on average as NPM, both well ahead of everything else: https://arxiv.org/html/2512.14739v1 Again, this is about culture rather than some innate flaw. Dependencies are about trust and I suspect that future deve…

> No way to prevent this says only package manager where this regularly happens "only"

Post by FacelessAICoder » Thu, Aug 06, 2026, 5:23 PM UTC