Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

socket.dev

Post reply on HN
Print view View original

1–10 of 1001 posts

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#1

Post by jamesberthoty »

A lot of blogs on this are AI generated and such as this is developing, so just linking to a bunch of resources out there:

Socket:

- Sep 15 (First post on breach): https://socket.dev/blog/tinycolor-supply-chain-attack-affect...

- Sep 16: https://socket.dev/blog/ongoing-supply-chain-attack-targets-...

StepSecurity – https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-p...

Aikido - https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-...

Ox - https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hi...

Safety - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack

Phoenix - https://phoenix.security/npm-tinycolor-compromise/

Semgrep - https://semgrep.dev/blog/2025/security-advisory-npm-packages...

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised
socket.dev

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#4

Post by dist-epoch »

gchamonlive wrote: post #2

We've seen many reports of supply chain attacks affecting NPM. Are these symptoms of operational complexity, which can affect any such service, or is there something fundamentally wrong with NPM?

It's just where the users and the juicy targets are.

NPM packages are used by huge Electron apps like Discord, Slack, VS Code, the holy grail would be to somehow slip something inside them.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#5

Post by motorest »

freakynit wrote: post #3

New day, new npm malware. Sigh..

> New day, new npm malware. Sigh..

This. But the problem seems to go way deeper than npm or whatever package manager is used. I mean, why is anyone consuming a package like colors or tinycolors? Do projects really need to drag in a random dependency to handle these usecases?

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#6

Post by liveoneggs »

gchamonlive wrote: post #2

We've seen many reports of supply chain attacks affecting NPM. Are these symptoms of operational complexity, which can affect any such service, or is there something fundamentally wrong with NPM?

It's the entire blase nature of js development in general.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#7

Post by koakuma-chan »

gchamonlive wrote: post #2

We've seen many reports of supply chain attacks affecting NPM. Are these symptoms of operational complexity, which can affect any such service, or is there something fundamentally wrong with NPM?

> is there something fundamentally wrong with NPM?

Its users don't check who the email is from

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#8

Post by anthk »

dist-epoch wrote: post #4
gchamonlive wrote: post #2

We've seen many reports of supply chain attacks affecting NPM. Are these symptoms of operational complexity, which can affect any such service, or is there something fundamentally wrong with NPM?

It's just where the users and the juicy targets are. NPM packages are used by huge Electron apps like Discord, Slack, VS Code, the holy grail would be to somehow slip something inside them.

Every NPM turd should be run with bubblewrap or a similar sandbox toolkit at least.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#9

Post by diggan »

motorest wrote: post #5
freakynit wrote: post #3

New day, new npm malware. Sigh..

> New day, new npm malware. Sigh.. This. But the problem seems to go way deeper than npm or whatever package manager is used. I mean, why is anyone consuming a package like colors or tinycolors? Do projects really need to drag in a random dependency to handle these usecases?

So rather than focusing on how Microsoft/npm et al can prevent similar situations in the future, you chose to think about what relevance/importance each individual package has?

There will always be packages that for some people are "but why?" but for others are "thank god I don't have to deal with that myself". Sure, colors and whatnot are tiny packages we probably could do without, but what are you really suggesting here? Someone sits and reviews every published package and rejects it if the package doesn't fit your ideal?

Post reply on HN