Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

201–210 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#201

Post by taleodor »

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

If you're looking for practical recommendations how to work with npm maintaining reasonable safety expectations, my post here mostly covers it: https://worklifenotes.com/2025/09/24/npm-has-become-a-russia...

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#202

Post by prmph »

There is no easy solution to these problems.

The solutions that are effective also involve actually doing work, as developers, library authors, and package managers. But no, we want as much "convenience" as possible, so the issues continue.

Developers and package authors should use a lockfile, pin their dependencies, be frugal about adding dependencies, and put any dependencies they do add through a basic inspection at least, checking what dependencies they also use, their code and tests quality, etc.

Package managers should enforce namespacing for ALL packages, should improve their publishing security, and should probably have an opt-in verified program for the most important packages.

Doing these will go a long way to ameliorate these supply chain attacks.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#204

Post by woodruffw »

jacquesm wrote: post #54
darkamaul wrote: post #26

The "use cooldown" [0] blog post looks particularly relevant today. I'd argue automated dependency updates pose a greater risk than one-day exploits, though I don't have data to back that up. That's harder to undo a compromised package already in thousands of lock files, than to manually patch a already exploited vulnerability in your dependencies. [0] https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

But even then you are still depending on others to catch the bugs for you and it doesn't scale: if everybody did the cooldown thing you'd be right back where you started.

The assumption in the post is that scanners are effective at detecting attacks within the cooldown period, not that end-device exploitation is necessary for detection.

(This may end up not being true, in which case a lot of people are paying security vendors a lot of money to essentially regurgitate vulnerability feeds at them.)

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#205

Post by tmvnty »

AndroTux wrote: post #93
amiga386 wrote: post #68

"No Way To Prevent This" Says Only Package Manager Where This Regularly Happens

Okay then, tell me a way to prevent this.

Other than general security practices, here are few NPM ecosystem specific ones: https://github.com/bodadotsh/npm-security-best-practices

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#206

Post by liveoneggs »

AndroTux wrote: post #88
gred wrote: post #74

Earlier quoted context omitted.

NPM has about 4 million packages, Maven Central has about 3 million packages. If this were true, wouldn't there have been at least one Maven attack by now, considering the number of NPM attacks that we've seen?

Okay then, explain to me why this is only possible with NPM? Does it have a hidden "pwn" button that I don't know about?

https://docs.npmjs.com/cli/v8/using-npm/scripts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#207

Post by codedokode »

junon wrote: post #193
throwawayffffas wrote: post #147

> Upon execution, the malware downloads and runs TruffleHog to scan the local machine, stealing sensitive information such as NPM Tokens, AWS/GCP/Azure credentials, and environment variables. That's a wake up call to harden your operations. NPM Tokens, AWS/GCP/Azure credentials have no reason to be available in environments where packages may be installed. The same goes for sensitive environment variables.

That's the goal, but it's not feasible in e.g. professional settings. Much easier said than done, unfortunately.

My code editor works in a sandbox. It's difficult because Linux doesn't provide it and one has to write it manually using shell scripts, random utilities. For example, I had also to write a limited FUSE emulation of /proc to allow code editor work without access to real /proc which contains lot of unnecessary information.

And if it's a "professional" setting, the company could hire a part-time developer for writing the sandbox.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#208

Post by tmvnty »

codedokode wrote: post #191

Does NPM use any automatic scanners? Just scanning for eval/new Function/base64 and other tokens often used by malware, and requiring a manual review, could already help. Also package manager should not run scripts.

Not aware of any NPM native ways but here are few community tools:

- https://socket.dev/blog/introducing-socket-firewall - https://github.com/lirantal/npq - https://bun.com/docs/pm/security-scanner-api

source: https://github.com/bodadotsh/npm-security-best-practices?tab...

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#209

Post by exceptione »

My motto wrt language choices: "It's the standard lib, stupid!"

My ultra hot take: there are only¹ two² programming ecosystems suitable for serious³ work:

  - .net (either run on CLR or compile as an AOT standalone binary)
  - jvm
The reason why is because they have a vast and vetted std lib. A good standard lib is a bigger boost then any other syntactic niceties.

  __
  1. I don't want other programming languages to die, so I am happy if you disagree with me. Other valid objection: some problems are better served by niche languages. Still, both .net and java support a plethora of niche languages.
  2. Shades of gr[e|a]y, some languages are more complete out of the box than others. 
  3. cf «pick boring tools»

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#210

Post by jollyllama »

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

Hell no.

You need standalone dependencies, like Tailwind offers with its standalone CLI. Predators go where there prey is. NPM is a monoculture. It's like running Windows in the 90's; you're just asking for viruses. But 90% of frontend teams will still use NPM because they can't figure anything else out.

Post reply on HN