Shai-Hulud Returns: Over 300 NPM Packages Infected • Hacker News Board

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#111

Post by eptcyka » Mon, Nov 24, 2025, 11:45 AM UTC

sph wrote: post #7

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Go is just as bad.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#112

Post by chha » Mon, Nov 24, 2025, 11:45 AM UTC

gred wrote: post #74

Gigachad wrote: post #13

Earlier quoted context omitted.

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?

Been a while since I looked into this, but afaik Maven Central is run by Sonatype, which happens to be one of the major players for systems related to Supply Chain Security.

From what I remember (a few years old, things may have changed) they required devs to stage packages to a specific test env, packages were inspected not only for malware but also vulnerabilities before being released to the public.

NPM on the other hand... Write a package -> publish. Npm might scan for malware, they might do a few additional checks, but at least back when I looked into it nothing happened proactively.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#113

Post by zenmac » Mon, Nov 24, 2025, 11:46 AM UTC

sph wrote: post #7

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Just a last month someone was trying to figure the cargo tree on which Rust package got imported implicitly via which package. This will totally happen in rust as well as long as you use some kind of package manager. Go for zero or less decencies.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#114

Post by actionfromafar » Mon, Nov 24, 2025, 11:47 AM UTC

zenmac wrote: post #113

sph wrote: post #7

Earlier quoted context omitted.

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Just a last month someone was trying to figure the cargo tree on which Rust package got imported implicitly via which package. This will totally happen in rust as well as long as you use some kind of package manager. Go for zero or less decencies.

less?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#115

Post by viraptor » Mon, Nov 24, 2025, 11:48 AM UTC

sandruso wrote: post #27

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

You can go very far with just node alone (accepts typescript without tsc, has testing framework,...). Include pg library that has no dependencies. Build a thin layer above node and you can have pretty stable setup. I got burnt so many times that I think it is simply impossible to build something that won't break within 3 months if you start including batteries. When it comes to frontend, well I don't have answers yet…

You can write simple front-end without reactive components. Most pages are not full blown apps and they were fine for a very long time with jQuery, whose features have been largely absorbed into plain js/dom/CSS.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#116

Post by zenmac » Mon, Nov 24, 2025, 11:48 AM UTC

globalise83 wrote: post #105

amiga386 wrote: post #68

"No Way To Prevent This" Says Only Package Manager Where This Regularly Happens

No Preventative Measures (NPM)

You can host your own NPM reg, and examine every package, but your manager probably is NOT going to go for that.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#117

Post by sph » Mon, Nov 24, 2025, 11:48 AM UTC

blueflow wrote: post #96

AndroTux wrote: post #93

Earlier quoted context omitted.

Okay then, tell me a way to prevent this.

The same way it always has been done - vendor your deps.

To be fair this does only work in ecosystems where libraries are stable and don't break every 3 months as it often happens on the JS world.

You can vendor your left-pad, but good luck doing that with a third-party SDK.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#118

Post by kibwen » Mon, Nov 24, 2025, 11:49 AM UTC

TheFlyingFish wrote: post #70

sph wrote: post #7

Earlier quoted context omitted.

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

I've worried about this for a while with Rust packages. The total size of a "big" Rust project's dependency graph is pretty similar to a lot of JS projects. E.g. Tauri, last I checked, introduces about 600 dependencies just on its own. Like another commenter said, I do think it's partially just because dependency management is so easy in Rust compared to e.g. C or C++, but I also suspect that it has to do with the si…

> Rust and JS are both famous for having minimal standard libraries

I'm all in favor of embiggening the Rust stdlib, but Rust and JS aren't remotely in the same ballpark when it comes to stdlib size. Rust's stdlib is decidedly not minimal; it's narrow, but very deep for what it provides.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#119

Post by thih9 » Mon, Nov 24, 2025, 11:49 AM UTC

amiga386 wrote: post #68

"No Way To Prevent This" Says Only Package Manager Where This Regularly Happens

Parent comment is an indirect reference to US mass shootings:.

> "'No Way to Prevent This,' Says Only Nation Where This Regularly Happens" is the recurring headline of articles published by the American news satire organization The Onion after mass shootings in the United States.

Source: https://en.wikipedia.org/wiki/%27No_Way_to_Prevent_This,%27_...

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#120

Post by master-lincoln » Mon, Nov 24, 2025, 11:50 AM UTC

gred wrote: post #74

Gigachad wrote: post #13

Earlier quoted context omitted.

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?

No. Having many packages might not be the only reason to start an attack. This post shows it is/was possible in the Maven ecosystem: https://blog.oversecured.com/Introducing-MavenGate-a-supply-...