cross-posted from: https://lemmy.bestiver.se/post/758000
Shai-Hulud Returns: Over 300 NPM Packages Infected
https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24
https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24
cross-posted from: https://lemmy.bestiver.se/post/758000
13 Comments
SnoringEarthworm@sh.itjust.works · 47 pts · 272d
"No Way To Prevent This" Says Only Package Manager Where This Regularly Happens*
::: spoiler * This is a joke about gun violence. :::
InternetCitizen2@lemmy.world · 15 pts · 272d
Real question? Is it really isolated to npm or is there a few lessons others could take and discover their own vulnerabilities?
frongt@lemmy.zip · 12 pts · 272d
It happens in python pip too.
Eldritch@piefed.world · 5 pts · 272d
Arch checking in. It may happen less. But it still does.
orclev@lemmy.world · 8 pts · 272d
To be fair to Arch, the AUR was always advertised as a caveat emptor type thing. It never really claimed to be secure in the first place.
Eldritch@piefed.world · 2 pts · 272d
That is fair.
nyan@lemmy.cafe · 8 pts · 272d
Python and Ruby have both had various repo issues too.
I've never heard of anything similar with Perl, but that may partly be because applications for new developers who want to join CPAN still appear to be processed by humans, with up to a couple of weeks lag. The time inefficiency plus the language being less popular probably makes it an unattractive target.
_cryptagion@anarchist.nexus · 19 pts · 272d
InternetCitizen2@lemmy.world · 2 pts · 272d
NOT_RICK@lemmy.world · 4 pts · 272d
Thought this was a reference to the hardcore band for a second… seeing them next month for the first time. I’m pumped! Sucks the malware is back
Schmuppes@lemmy.today · 6 pts · 272d
It's surely a reference to the Dune novels.
NOT_RICK@lemmy.world · 1 pts · 272d
Yup
camdog2000@ttrpg.network · 3 pts · 272d
I avoid NPM like the plague.
I feel like I'm better off for it.
fubarx@lemmy.world · 2 pts · 272d
That is pretty evil.
Without signing attestation (both developer and code) there will be no way to find out who was responsible and stop the propagation. This will happen again.
Edit: there have been attempts like https://docs.npmjs.com/trusted-publishers, but that hasn't fixed the problem.