Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

431–440 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#431

Post by alehlopeh »

btbuildem wrote: post #411
shadymoney wrote: post #407

This is why I am not a huge fan of separate package managers for libraries, such as in the case of rust, or node. The C style of sharing deps. couldn't really be simpler as just including the headers in your Makefile. We really don't need more package managers other than the ones provided by your operating system, but I dunno maybe its just me.

The JS ecosystem in particular, it really seems like it was built by people hell-bent on reinventing the wheel and making all the mistakes / paying all the costs along the way. It's a pretty octagonal wheel so far, but maybe they'll get there eventually.

Ecosystems aren’t built by any homogeneous group of people. They’re a sum of their parts. It’s not like there was a committee and that committee decided how things should work wrt wheel reinvention. People publish packages, and the result is something we call an ecosystem.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#432

Post by moebrowne »

loloquwowndueo wrote: post #270
moebrowne wrote: post #179

Earlier quoted context omitted.

The point of the cooldown is to allow time for vendor scans to complete and for compromised packages to be pulled. It's not about waiting for an end user to notice they've been compromised. > Meanwhile, the aforementioned vendors are scanning public indices as well as customer repositories for signs of compromise, and provide alerts upstream (e.g. to PyPI). https://blog.yossarian.net/2025/11/21/We-should-all-be-using…

Depending on “security vendors” to do scans of every single update seems naive and over optimistic to me, but hey - everyone’s jumping on the bandwagon regardless of what I think so I guess we’ll see soon.

What's the alternative?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#433

Post by kunley »

exceptione wrote: post #274
querez wrote: post #216

Earlier quoted context omitted.

Arguably both Go and Python also have great stdlibs. The only advantage that JVM and .NET have is a default GUI package. Which is fair, but keeps getting less and less relevant as people rely more on web UIs.

Respectfully disagree. Python and Go std lib do not even play in the same league. I had to help someone with datetime¹ handling in Python a while back. The stdlib is so poor, you have to reach out for a thirdparty lib for even the most basic of tasks². Don't take my word for it, take a dive. You wouldn't be the first to have adjust their view. For example, this section is just about the built-in web framework asp.net…

You helped someone with Python, and what evidence do you have justifying your claims about alleged Go stdlib narrowness?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#434

Post by nine_k »

ryandrake wrote: post #388
tim1994 wrote: post #371

Earlier quoted context omitted.

Because updates don't just include new features but also bug and security fixes. As always, it probably depends on the context how relevant this is to you. I agree that cooldown is a good idea though.

> Because updates don't just include new features but also bug and security fixes. This practice needs to change, although it will be almost impossible to get a whole ecosystem to adopt. You shouldn’t have to take new features (and associated new problems) just to get bug fixes and security updates. They should be offered in parallel. We need to get comfortable again with parallel maintenance branches for each major…

Semver was invented to facilitate that. Only if everyone adhered to it.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#435

Post by rco8786 »

nathan_compton wrote: post #426

I never, ever, do development outside of a podman container these days. Basically if I am going to run some code from somewhere and I haven't read it, it goes in a container. I know its not foolproof, but I can't believe how often people run code they haven't read where it can make a huge mess, steal secrets, etc. I'll probably get owned someday, I'm sure, but this feels like a bare minimum.

How are you doing this in practice? These are npm packages. I don't see how could reasonably pull in Posthog's SDK in a container.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#436

Post by christophilus »

rco8786 wrote: post #435
nathan_compton wrote: post #426

I never, ever, do development outside of a podman container these days. Basically if I am going to run some code from somewhere and I haven't read it, it goes in a container. I know its not foolproof, but I can't believe how often people run code they haven't read where it can make a huge mess, steal secrets, etc. I'll probably get owned someday, I'm sure, but this feels like a bare minimum.

How are you doing this in practice? These are npm packages. I don't see how could reasonably pull in Posthog's SDK in a container.

What do you mean? You can drop into bash in a container and run any arbitrary command, so `npm install foo` works just fine. Why would posthog's SDK be a special case?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#438

Post by yupyupyups »

plomme wrote: post #346
darkamaul wrote: post #26

The "use cooldown" [0] blog post looks particularly relevant today. I'd argue automated dependency updates pose a greater risk than one-day exploits, though I don't have data to back that up. That's harder to undo a compromised package already in thousands of lock files, than to manually patch a already exploited vulnerability in your dependencies. [0] https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

Why not take it further and not update dependencies at all until you need to because of some missing feature or systems compatibility you need? If it works it works.

Just make sure to update when new CVEs are revealed.

Also, some software are always buggy and every version is a mixed bag of new features, bugs and regressions. It could be due to the complexity of the problem the software is trying to solve, or because it's just not written well.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#439

Post by herpdyderp »

hedora wrote: post #402
herpdyderp wrote: post #301

Earlier quoted context omitted.

Also add it to ~/.npmrc!

So, I do this because it's universally recommended, but why does it help? Can't they just jam the malware into the package itself? It runs with the same permissions on my machine (in unit tests, node servers, etc).

> why does it help?

Because install scripts are being actively exploited, so blocking them will reduce your exposure. Install scripts will also run anywhere that runs npm ci, npm install, etc., including build pipelines.

> Can't they just jam the malware into the package itself

Yes. Disabling install scripts won't safeguard you from all attack vectors.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#440

Post by limagnolia »

Yokohiii wrote: post #335
__s wrote: post #221

Earlier quoted context omitted.

There are companies like Helix Guard scanning registries. They advertise static analysis / LLM analysis, but honeypot instances can also install packages & detect certain files like cloud configs being accessed

But relying on the goodwill of commercial sec vendors is it's own infrastructure risk.

So don't rely on their goodwill? Instead, pay them, under a contract.. or do it yourself.
Post reply on HN