Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Shai-Hulud Returns: Over 300 NPM Packages Infected

helixguard.ai

Post reply on HN
Print view View original

521–530 of 797 posts

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#521

Post by venturecruelty »

jacquesm wrote: post #56
rvz wrote: post #16

Very concerning, so that was what the "impending disaster" was as I first noted. [0] Quite worrying that this happened again to the NPM ecosystem. Really looking forward to a deeper post-mortem on this. [0] https://news.ycombinator.com/item?id=46031864

It will keep happening until someone takes responsibility and starts maintaining the whole of the node eco system. This is probably a viable start-up idea: Node but audited.

You don't even need to enshittify Yet Another Service, you just need package maintainers. Debian manages to do this, and I'm guessing they get paid nothing (although, yeah, Amazon and The Goog really ought to chip in a few bucks, considering their respective empires). Unfortunately, it means you can't just YOLO your code into other people's programs anymore.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#522

Post by bootsmann »

jacquesm wrote: post #54
darkamaul wrote: post #26

The "use cooldown" [0] blog post looks particularly relevant today. I'd argue automated dependency updates pose a greater risk than one-day exploits, though I don't have data to back that up. That's harder to undo a compromised package already in thousands of lock files, than to manually patch a already exploited vulnerability in your dependencies. [0] https://blog.yossarian.net/2025/11/21/We-should-all-be-using...

But even then you are still depending on others to catch the bugs for you and it doesn't scale: if everybody did the cooldown thing you'd be right back where you started.

It does scale against this form of attack. This attack propagates by injecting itself into the packages you host. If you pull only 7d after release you are infected 7d later. If your customers then also only pull 7d later they are pulling 14d after the attack has launched, giving defenders a much longer window by slowing down the propagation of the worm.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#523

Post by liampulles »

Ok, I think the verdict on the "JavaScript for everything" experiment is in. It was already resolved long ago (in my opinion), but this should convince any stragglers. Let's accept that the one thing JS is really great for is DOM patching, and move on.

Going forward, use WASM if you really want to make an SPA (and think about that choice), where the source language is not something that ties into the JS dependency ecosystem. Ban it and burn it with fire for anything on the backend, for christ.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#524

Post by [deleted] »

AmazingTurtle wrote: post #354

I looked through some of the GH repositories and - dear god - there are some crazy sensitive secrets in there. AWS Prod database credentials, various API keys (stripe, google, apple store, ...), passwords for databases, encryption keys, ssh keys, ... I think hijacked NPM packages are just the tip of the ice berg.

[deleted]

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#525

Post by benmccann »

mcintyre1994 wrote: post #505
benmccann wrote: post #483

Hundreds of people had access to publish the Zapier SDK, so it's little surprise they were eventually compromised! ( https://bsky.app/profile/benmccann.com/post/3m6fdecsbdk2u ) The e18e community are reducing dependencies in popular libraries and building tools to prevent and reduce the impact of such attacks. Join if you want to help out! https://e18e.dev/ Just this morning, after trying to make the case over the pa…

FYI your first link is the same as your third link. It's correct as the third link, so the Zapier one is missing.

fixed!

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#526

Post by jacquesm »

venturecruelty wrote: post #521
jacquesm wrote: post #56

Earlier quoted context omitted.

It will keep happening until someone takes responsibility and starts maintaining the whole of the node eco system. This is probably a viable start-up idea: Node but audited.

You don't even need to enshittify Yet Another Service, you just need package maintainers. Debian manages to do this, and I'm guessing they get paid nothing (although, yeah, Amazon and The Goog really ought to chip in a few bucks, considering their respective empires). Unfortunately, it means you can't just YOLO your code into other people's programs anymore.

> Unfortunately, it means you can't just YOLO your code into other people's programs anymore.

That's a good thing, in my book.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#527

Post by venturecruelty »

kome wrote: post #97

why don't web devs just learn html and css properly, and maybe xslt for the really complex transformations then use vanilla js only when it's truly necessary? instead we've got this absolute mess of bloated, over-engineered junk code and ridiculously complicated module systems.

Because then how would they pay their inflated Bay Area rent?

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#528

Post by pixl97 »

philipwhiuk wrote: post #489
jamietanna wrote: post #456

See also: https://news.ycombinator.com/item?id=46005111 As it arguably would have reduced impact (I'm one of the Renovate maintainers and have recently pushed for this to be more of a widely used feature)

I think everyone just gets hit after 7 days frankly.

Why? Everyone won't use cooldowns, but the key is to have just enough people running brand new to set off a warning/have systems that check dependencies scan and find vulns go off and the packages get pulled before production builds them.

Monocultures where everyone pulls and builds with every brand new thing for the most minor changes is dangerous.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#529

Post by venturecruelty »

jacquesm wrote: post #526
venturecruelty wrote: post #521

Earlier quoted context omitted.

You don't even need to enshittify Yet Another Service, you just need package maintainers. Debian manages to do this, and I'm guessing they get paid nothing (although, yeah, Amazon and The Goog really ought to chip in a few bucks, considering their respective empires). Unfortunately, it means you can't just YOLO your code into other people's programs anymore.

> Unfortunately, it means you can't just YOLO your code into other people's programs anymore. That's a good thing, in my book.

Oh, agreed 100%. I find it endlessly frustrating that these same conversations happen every single time there's a supply chain attack like this, because nobody wants an _actual_ solution, they want an _easy_ solution that doesn't involve changing anything about how they work. So we just get 500 comments asking if we can solve the Halting Problem, and then everyone forgets until the next breach. It was ever thus.

Re: Shai-Hulud Returns: Over 300 NPM Packages Infected

#530

Post by jama211 »

embedding-shape wrote: post #513
twistedpair wrote: post #469

ProTip: use PNPM, not NPM. PNPM 10.x shutdown a lot of these attack vectors. 1. Does not default to running post-install scripts (must manually approve each) 2. Let's you set a min age for new releases before `pnpm install` will pull them in - e.g. 4 days - so publishers have time to cleanup. NPM is too insecure for production CLI usage. And of course make a very limited scope publisher key, bind it to specific packa…

> NPM is too insecure for production CLI usage. NPM was never "too insecure" and remains not "too insecure" today. This is not an issue with npm, JavaScript, NodeJS, the NodeJS foundation or anything else but the consumer of these libraries pulling in code from 3rd parties and pushing it to production environments without a single review. How this still fly today, and have been since the inception of public "easy to…

“Personally, I never wear a seatbelt because all drivers on the road should just follow the road rules instead and drive carefully.”

I don’t control all the drivers on the road, and a company can’t magically turn all employees into perfect developers. Get off your high horse and accept practical solutions.

Post reply on HN