Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

411–420 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#411

Post by btbuildem »

shadymoney wrote: post #407

This is why I am not a huge fan of separate package managers for libraries, such as in the case of rust, or node. The C style of sharing deps. couldn't really be simpler as just including the headers in your Makefile. We really don't need more package managers other than the ones provided by your operating system, but I dunno maybe its just me.

The JS ecosystem in particular, it really seems like it was built by people hell-bent on reinventing the wheel and making all the mistakes / paying all the costs along the way. It's a pretty octagonal wheel so far, but maybe they'll get there eventually.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#412

Post by cesarb »

Ygg2 wrote: post #25
I_am_tiberius wrote: post #15

I guess you should never use the latest versions of libraries.

But you also need the latest versions to avoid zero-day attacks.

Or an old enough version. For one of the most damaging zero-day vulnerabilities in the Java ecosystem (log4shell), you were vulnerable if you were in the latest version, but not vulnerable if you were using an old enough version.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#413

Post by kunley »

plomme wrote: post #346
darkamaul wrote: post #26

The "use cooldown" [0] blog post looks particularly relevant today. I'd argue automated dependency updates pose a greater risk than one-day exploits, though I don't have data to back that up. That's harder to undo a compromised package already in thousands of lock files, than to manually patch a already exploited vulnerability in your dependencies. [0] https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

Why not take it further and not update dependencies at all until you need to because of some missing feature or systems compatibility you need? If it works it works.

> Why not take it further and not update dependencies at all until you need to because of some missing feature or systems compatibility you need? If it works it works.

Indeed there are people doing that and communities with a consensus such approach makes sense, or at least is not frowned upon. (Hi, Gophers)

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#414

Post by btbuildem »

bodash wrote: post #217

I compiled a list of NPM best practices one can adopt to reduce supply chain attack risks (even if there's no perfect security preventions, _always_): https://github.com/bodadotsh/npm-security-best-practices Discussion on HN last time: https://news.ycombinator.com/item?id=45326754

I have a shorter list of NPM best practices:

1. Don't

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#415

Post by drw85 »

cluckindan wrote: post #229
DamonHD wrote: post #153

Earlier quoted context omitted.

When I last looked (as a consulting dev in a bank or three, horrified) absolutely they had not!

If this was in the US, all financial institutions need to audit their code to comply with NIST SP 800-53. If they haven’t, it would be ethically dubious for you to not report it.

In my experience, most devs and companies don't consider the dependencies they load 'their' code. They only look at the code they write, not everything they deploy.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#417

Post by [deleted] »

kunley wrote: post #373

Why the biggest package mess is always with the Node ecosystem? Why in particular this community still insists on preemptively updating all deps always, on running complicated extra hooks together with package installation and pretending this all is good engineering practices? ("Look, we have so plenty of things and are so busy, thus it must be good") Why certain kind of mindset is typical to this community? Why the…

[deleted]

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#418

Post by btbuildem »

SkyPuncher wrote: post #409
amiga386 wrote: post #68

"No Way To Prevent This" Says Only Package Manager Where This Regularly Happens

The circumstances for this are not unique to NPM. The popularity is what makes it so susceptible to these attacks.

It's not just the popularity, it's partly the update mechanism and partly the culture. In what sane world would you always pull in all the newest things, regardless or whether you need them or not? This is a default at build time for so many setups. If you absolutely must use that package manager, at least lock down your versions, and update selectively. I don't even know if that's possible to do with the dependencies' dependencies (and so on), or are people forced to just pull in whatever, every time.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#419

Post by kortex »

shadymoney wrote: post #407

This is why I am not a huge fan of separate package managers for libraries, such as in the case of rust, or node. The C style of sharing deps. couldn't really be simpler as just including the headers in your Makefile. We really don't need more package managers other than the ones provided by your operating system, but I dunno maybe its just me.

That ship has sailed, traveled around the world, and docked in a foreign port at this point.

Including headers isn't remotely "simple". There's so many considerations in linking, .SO version compatibility, architecture and instruction set issues, building against multiple versions on the same system. Or if you want to feel frustrated in a single word: GDAL (IYKYK)

And that's only where #include is even applicable. That is not gonna fly for any interpreted language - JS in this case, but also python, ruby, php.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#420

Post by DamonHD »

cluckindan wrote: post #229
DamonHD wrote: post #153

Earlier quoted context omitted.

When I last looked (as a consulting dev in a bank or three, horrified) absolutely they had not!

If this was in the US, all financial institutions need to audit their code to comply with NIST SP 800-53. If they haven’t, it would be ethically dubious for you to not report it.

These were all multinationals, with very significant US presence.
Post reply on HN