Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised • Hacker News Board

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#731

Post by parlortricks » Wed, Sep 17, 2025, 3:17 AM UTC

collinmanderson wrote: post #617

kelnos wrote: post #405

As a user of npm-hosted packages in my own projects, I'm not really sure what to do to protect myself. It's not feasible for me to audit every single one of my dependencies, and every one of my dependencies' dependencies, and so on. Even if I had the time to do that, I'm not a typescript/javascript expert, and I'm certain there are a lot of obfuscated things that an attacker could do that I wouldn't realize was embed…

> sort of a "delayed" mode to updating my own dependencies. The idea is that when I want to update my dependencies, instead of updating to the absolute latest version available of everything, it updates to versions that were released no more than some configurable amount of time ago. For Python's uv, you can do something like: > uv lock --exclude-newer $(date --iso -d "2 days ago")

oh that uv lock is neat, i am going to give that a go

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#732

Post by yawaramin » Wed, Sep 17, 2025, 3:26 AM UTC

floydnoel wrote: post #155

reactordev wrote: post #70

Earlier quoted context omitted.

Until you go get malware Supply chain attacks happen at every layer where there is package management or a vector onto the machine or into the code. What NPM should do if they really give a shit is start requiring 2FA to publish. Require a scan prior to publish. Sign the package with hard keys and signature. Verify all packages installed match signatures. Semver matching isn’t enough. CRC checks aren’t enough. This h…

NPM does require 2FA to publish. I would love a workaround! Isn't it funny that even here on HN, misinformation is constantly being spread?

npm offers 2FA but it doesn't really advertise that it has a phishing-resistant 2FA (security keys, aka passkeys, aka WebAuthn) available and just happily lets you go ahead and use a very phishable OTP if you want. I place much of the blame for publishers getting phished on npm.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#733

Post by lyu07282 » Wed, Sep 17, 2025, 3:28 AM UTC

totetsu wrote: post #676

I was just reading an article in Foreign Affairs that was discussing a possible future with an increased separation of science and technological developments between China and The West. And it occurred to me, what would such a siloed landscape mean for OSS and basically the whole web infrastructure as it is today, shared and open for anyone in any country. I think this kind of malware becoming pervasive could be the…

I always thought open source in a purely profit driven society was always a bit contradictory, but it's like the wikipedia. There is just something innate in people that makes them care for their craftsmanship and their community with zero profit incentive, despite the prevailing ideology telling us that it ought to be impossible and surely about to collapse any moment now. OSS will prevail no matter Microsoft's disastrous and irresponsible stewardship of a smallish portion of it.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#734

Post by yawaramin » Wed, Sep 17, 2025, 3:28 AM UTC

jddj wrote: post #51

codemonkey-zeta wrote: post #31

I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…

Is the difference between the number of dev dependencies for eg. VueJs (a JavaScript library for marshalling Json Ajax responses into UI) and Htmx (a JavaScript library for marshalling html Ajax responses into UI) meaningful? There is a difference, but it's not an order of magnitude and neither is a true island. Granted, deciding not to use JS on the server is reasonable in the context of this article, but for the cl…

Except that htmx's recommended usage is as a single injected directly into your HTML page, not as an npm dependency. So unless you are an htmx contributor you are not going to be installing the dev dependencies.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#735

Post by 9dev » Wed, Sep 17, 2025, 3:30 AM UTC

cyrnel wrote: post #699

Code signing, 2FA, and reducing dependencies are all incomplete solutions. What we need is fine-grained sandboxing, down to the function and type level. You will always be vulnerable as long as you're relying on fallible humans (even yourself) to catch or prevent vulnerabilities. Apparently they've tried to implement this in JavaScript but the language is generally too flexible to resist a malicious package running i…

That doesn’t solve it either. If you need to grant hundreds of permissions, people will just hand-wave them all—remember the UAC debacle in Windows Vista? I like Denos approach way better; and you could also ask why any application can just read files in your home folder, or make network requests to external hosts. OSes really are part of the equation here.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#736

Post by yawaramin » Wed, Sep 17, 2025, 3:31 AM UTC

jmull wrote: post #221

codemonkey-zeta wrote: post #31

I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…

Simply avoiding Javascript won't cut it. While npm is a huge and easy target, the general problem exists for all package repositories. Hopefully a supply chain attack mitigation strategy can be better than hoping attackers target package repositories you aren't using. While there's a culture prevalent in Javascript development to ignore the costs of piling abstractions on top of abstractions, you don't have to buy in…

> Simply avoiding Javascript won't cut it.

But it will cut a large portion of it.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#737

Post by nromiun » Wed, Sep 17, 2025, 3:31 AM UTC

Klonoar wrote: post #727

nromiun wrote: post #380

Earlier quoted context omitted.

Not to the same extent as NPM. Because Python has a good standard library and library authors are not deathly afraid of code duplication like JS devs, for example micro libraries like left-pad, is-even etc.

The weird dig at JS as a community is wholly unnecessary. Python as an ecosystem is just as vulnerable to this crap - and they’ve had their own issues with it. You can reference that and leave the color commentary at the door.

Unnecessary? Maybe if more people had commented on JS devs tendency to include every 3 line micro packages in existence we would not be in this situation.

Every ecosystem has this problem but NPM is the undisputed leader if you count all attacks.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#738

Post by what » Wed, Sep 17, 2025, 3:31 AM UTC

Ygg2 wrote: post #670

ncruces wrote: post #511

Earlier quoted context omitted.

Just the other day someone argued with me that it was reasonable for Limbo (the SQLite Rust rewrite) to have 3135 dependencies (of those, 1313 Rust dependencies). https://github.com/tursodatabase/turso/network/dependencies

Yeah. You have dev dependencies in there, those alone will increase number of dependencies by ~500, without ending up in the final product. Those numbers are way off their actual number.

500 dev dependencies doesn’t seem reasonable either…

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#739

Post by mdavidn » Wed, Sep 17, 2025, 3:32 AM UTC

RUnconcerned wrote: post #74

zachrip wrote: post #38

Earlier quoted context omitted.

I can tell a lot about a dev by the fact that they single out npm/js for this supply chain issue.

What other language ecosystems have had this happen systematically? This isn't even the first time this month!

RubyGems is susceptible too.

Re: Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

#740

Post by yawaramin » Wed, Sep 17, 2025, 3:33 AM UTC

EMM_386 wrote: post #597

codemonkey-zeta wrote: post #31

I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem. These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probab…

> The HTMX folks convinced me that I can get REALLY far without any JavaScript HTMX is JavaScript. Unless you meant your own JavaScript.

When we say 'htmx allows us to avoid JavaScript', we mean two things: (1) we typically don't need to rely on the npm ecosystem, because we need very few (if any) third-party JavaScript libraries; and (2) htmx and HTML-first allow us to avoid writing a lot of custom JavaScript that we would have otherwise written.