Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

31–40 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#31

Post by _alternator_ »

timgl wrote: post #4

co-founder of PostHog here. We were a victim of this attack. We had a bunch of packages published a couple of hours ago. The main packages/versions affected were: - posthog-node 4.18.1, 5.13.3 and 5.11.3 - posthog-js 1.297.3 - posthog-react-native 4.11.1 - posthog-docusaurus 2.0.6 We've rotated keys and passwords, unpublished all affected packages and have pushed new versions, so make sure you're on the latest versio…

Glad you updated on this front-page post. Your Twitter post is buried on p3 for me right now. Good luck on the recovery and hopefully this helps someone.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#32

Post by dkdbejwi383 »

AIorNot wrote: post #20
anonymous908213 wrote: post #17

Earlier quoted context omitted.

Node doesn't have any particular relation to NPM? You don't have to download 1000 other people's code. Writing your own code is a thing that you are legally allowed to do, even if you're writing in Javascript.

So your supposed to write your own posthog? be serious

If they have a HTTP API using standard authentication methods it's not that difficult to create a simple wrapper. Granted a bit more work if you want to do things like input/output validation too, but there's a trade-off between ownership there and avoiding these kinds of supply-chain attacks.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#33

Post by throw-the-towel »

vintagedave wrote: post #14

The list of packages looks like these are not just tiny solo-person dependencies-of-dependencies. I see AsyncAPI and Zapier there. Am I right that this seems quite a significant event? AsyncAPI is used as the example in the post. It says the Github repo was not affected, but NPM was. What I don't understand from the article is how this happened. Were the credentials for each project leaked? Given the wide range of pa…

My understanding is, it's a worm that injects itself into the current package and publishes infected code to npm.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#34

Post by merelysounds »

vintagedave wrote: post #14

The list of packages looks like these are not just tiny solo-person dependencies-of-dependencies. I see AsyncAPI and Zapier there. Am I right that this seems quite a significant event? AsyncAPI is used as the example in the post. It says the Github repo was not affected, but NPM was. What I don't understand from the article is how this happened. Were the credentials for each project leaked? Given the wide range of pa…

There is an explanation in the article:

> it modifies package.json based on the current environment's npm configuration, injects [malicious] setup_bun.js and bun_environment.js, repacks the component, and executes npm publish using stolen tokens, thereby achieving worm-like propagation.

This is the second time an attack like this happens, others may be familiar with this context already and share fewer details and explanations than usual.

Previous discussions: https://news.ycombinator.com/item?id=45260741

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#35

Post by zwnow »

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

Just keep the number of packages you use to a minimum. If some package itself has like 200 deps uninstall that and look for an alternative with less deps or think if you really need said package.

I also switched to Phoenix using Js only when absolutely necessary. Would do the same on Laravel at work if switching to SSR would be feasible...

I do not trust the whole js ecosystem anymore.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#36

Post by rvz »

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

> Serious question: should someone develop new technologies using Node any more?

I think we have given the Typescript / Javascript communities enough time. These sort of problems will continue to happen regardless of the runtime.

Adding one more library increases the risk of a supply-chain attack like this.

As long as you're using npm or any npm-compatible runtime, then it remains to be an unsolved recurring issue in the npm ecosystem.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#37

Post by jacquesm »

vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

> Serious question: should someone develop new technologies using Node any more?

Please, no.

It is an absolutely terrible eco system. The layercake of dependencies is just insane.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#38

Post by paradite »

anonymous908213 wrote: post #17
vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

Node doesn't have any particular relation to NPM? You don't have to download 1000 other people's code. Writing your own code is a thing that you are legally allowed to do, even if you're writing in Javascript.

npm has been the official package manager for node since forever (0.8 or earlier iirc). I think even before the io.js fork and merge.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#39

Post by cluckindan »

vintagedave wrote: post #19
Gigachad wrote: post #13

Earlier quoted context omitted.

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

The concern is not 'could' happen, but _does_ happen. I know this could occur in many places. But where it seems highly prevalent is NPM. And I am genuinely thinking to myself, is this making using npm a risk?

Just use dependency cooldown. It will mitigate a lot of risk.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#40

Post by Ygg2 »

vintagedave wrote: post #19
Gigachad wrote: post #13

Earlier quoted context omitted.

The problem isn't specific to node. NPM is just the most popular repo so the most value for attacks. The same thing could happen on RubyGems, Cargo, or any of the other package managers.

The concern is not 'could' happen, but _does_ happen. I know this could occur in many places. But where it seems highly prevalent is NPM. And I am genuinely thinking to myself, is this making using npm a risk?

NPM is the largest possible target for such an attack.

Attack an important package, and you can get into the Node and Electron ecosystem. That's a huge prize.

Post reply on HN