Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

381–390 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#381

Post by nfriedly »

tragiclos wrote: post #317
Sammi wrote: post #166

Earlier quoted context omitted.

Pretty easy to do using npm-check-update: https://www.npmjs.com/package/npm-check-updates#cooldown In one command: npx npm-check-updates -c 7

The docs list this caveat: > Note that previous stable versions will not be suggested. The package will be completely ignored if its latest published version is within the cooldown period. Seems like a big drawback to this approach.

I could see it being a good feature. If there have been two versions published within the last week or two, then there are reasonable odds that the previous one had a bug.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#382

Post by kunley »

jalapenos wrote: post #379
kunley wrote: post #373

Why the biggest package mess is always with the Node ecosystem? Why in particular this community still insists on preemptively updating all deps always, on running complicated extra hooks together with package installation and pretending this all is good engineering practices? ("Look, we have so plenty of things and are so busy, thus it must be good") Why certain kind of mindset is typical to this community? Why the…

Feels good, just for a second, to type pretence you're above everyone doesn't it? Just for those few seconds, you're better than a big whole arbitrary collection of people, and for those few seconds you have relief from the reality of your life.

No. I am tired of seeing people dragged into poor quality environments for the wrong reasons. These people would do much better using other tools.

Your attempt to make it personal does not compute.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#383

Post by poly2it »

TheDong wrote: post #304
galangalalgol wrote: post #227

Earlier quoted context omitted.

Network without async works fine in std. However, rand, serde, and num_traits always seem to be present. Not sure why clap isn't std at this point.

> Not sure why clap isn't std at this point. The std has stability promises, so it's prudent to not add things prematurely. Go has the official "flag" package as part of the stdlib, and it's so absolutely terrible that everyone uses pflag, cobra, or urfave/cli instead. Go's stdlib is a wonderful example of why you shouldn't add things willy-nilly to the stdlib since it's full of weird warts and things you simply shou…

Go is also famous for encouraging a culture of keeping down dependency count while exposing a simple to use package manager and ecosystem.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#384

Post by gdotdesign »

- There is a single root dependency somewhere which gets overtaken

- A new version of this dependency is published

- A CI somewhere of another NPM package uses this new version dependency in a build, which trigger propagation by creating a new modified version of this dependency?

- And so on...

Am I getting this right?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#385

Post by vintagedave »

jacquesm wrote: post #54
darkamaul wrote: post #26

The "use cooldown" [0] blog post looks particularly relevant today. I'd argue automated dependency updates pose a greater risk than one-day exploits, though I don't have data to back that up. That's harder to undo a compromised package already in thousands of lock files, than to manually patch a already exploited vulnerability in your dependencies. [0] https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

But even then you are still depending on others to catch the bugs for you and it doesn't scale: if everybody did the cooldown thing you'd be right back where you started.

That worried me too, a sort of inverse tragedy of the commons. I'll use a weeklong cooldown, _someone else_ will find the issue...

Until no-one does, for a week. To stretch the original metaphor, instead of an overgrazed pasture, we grow a communally untended thicket which may or may not have snakes when we finally enter.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#386

Post by shermantanktop »

tim1994 wrote: post #371
plomme wrote: post #346

Earlier quoted context omitted.

Why not take it further and not update dependencies at all until you need to because of some missing feature or systems compatibility you need? If it works it works.

Because updates don't just include new features but also bug and security fixes. As always, it probably depends on the context how relevant this is to you. I agree that cooldown is a good idea though.

For any update:

- it usually contains improvements to security

- except when it quietly introduces security defects which are discovered months later, often in a major rev bump

- but every once in a while it degrades security spectacularly and immediately, published as a minor rev

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#387

Post by kunley »

sph wrote: post #7
vintagedave wrote: post #2

Serious question: should someone develop new technologies using Node any more? A short time ago, I started a frontend in Astro for a SaaS startup I'm building with a friend. Astro is beautiful. But it's build on Node. And every time I update the versions of my dependencies I feel terrified I am bringing something into my server I don't know about. I just keep reading more and more stories about dangerous npm packages…

It's not "node" or "Javascript" the problem, it's this convenient packaging model. This is gonna ruffle some feathers, but it's only a matter of time until it'll happen on the Rust ecosystem which loves to depend on a billion subpackages, and it won't be fault of the language itself. The more I think about it, the more I believe that C, C++ or Odin's decision not to have a convenient package manager that fosters a ca…

Why the word "semblance" with regard to Go modules? Are you trying to say this system is lacking something?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#388

Post by ryandrake »

tim1994 wrote: post #371
plomme wrote: post #346

Earlier quoted context omitted.

Why not take it further and not update dependencies at all until you need to because of some missing feature or systems compatibility you need? If it works it works.

Because updates don't just include new features but also bug and security fixes. As always, it probably depends on the context how relevant this is to you. I agree that cooldown is a good idea though.

> Because updates don't just include new features but also bug and security fixes.

This practice needs to change, although it will be almost impossible to get a whole ecosystem to adopt. You shouldn’t have to take new features (and associated new problems) just to get bug fixes and security updates. They should be offered in parallel. We need to get comfortable again with parallel maintenance branches for each major feature branch, and comfortable with backporting fixes to older releases.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#389

Post by user34283 »

jacquesm wrote: post #109
notpachet wrote: post #101

Earlier quoted context omitted.

I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through. Not that there aren't problems with Node itself, but as many people have pointed out, there are plenty of organizations writing in Node that aren't pwn'd by these sorts of attacks because we don't blindly update deps. Perfect is the enemy of good; dependency cooldown etc is enough to mitigate the majority of…

> I feel like there are merits to your argument but that you have a larger anti-JS bias that's leaking through. Familiarity breeds contempt.

What's the problem?

I think JS is great. It's simple, anybody can use it.

TypeScript is excellent too. The structural type system is very convenient.

It's not going to replace Rust in cases where performance is essential or where you want strict runtime type checking or whatever, but for general use and graphical applications JS seems like a great pick.

I often hear people complain about JS, but really, how is it any worse than say Python?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#390

Post by Yokohiii »

joshstrange wrote: post #362
Yokohiii wrote: post #321

Earlier quoted context omitted.

Vendoring literally just means grabbing the source code from origin and commit it to your repo after a review. The expectation that every repo has important regular updates for you is pure FOMO. And if I don't do random updates for fun, nothing will every break. [redacted bullshit!]

> Version locking wont help you all the time, i.e. if you build fresh envs from scratch. I'm confused on this. I would imagine it would protect/help you as long as releases are immutable which they are for most package managers (like npm). > Vendoring literally just means grabbing the source code from origin and commit it to your repo after a review. Hmm, I don't think it always necessarily means grabbing the source,…

You are right about version locking, bullshit on my side, not sure what I was thinking.

I personally don't have a problem with the general ability to change vendor code. The question is whether you want it in an specific case or not. If you update frequently then certainly not. But that decision should be deliberate team policy.

Post reply on HN