Comment on: Keyv and friends compromised in active Shai-Hulud supply chain attack
It’s not that there’s a single stdlib feature which would’ve stopped this but more that JavaScript developers have been conditioned that it’s normal to install tons of packages and update them quite frequently so there are a lot of individual maintainers who if compromised have a surprising impact.You’re exposed as a function of the number of dependencies so the communities which most normalize many rapidly updating packages are going to be at greater risk. That’s not a simple trade off — that enterprise Java app which updates on a decadal cadence is still worse — but it means you need to acce
Comment on: Keyv and friends compromised in active Shai-Hulud supply chain attack
I ended up asking my agent with auto mode:can you search all installed node modules for any sign of the shai hulud supply chain attack? What happened
Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a "preinstall": "node setup.mjs" entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed.setup.mjs is a heavily obfuscated dropper. Its only job is to silently download the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases/download/
Comment on: Keyv and friends compromised in active Shai-Hulud supply chain attack
I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous.Surely Github's software is good enough that an intern can slop the 80/20 together in a day? It would be an actually good use of AI spending.
Comment on: Keyv and friends compromised in active Shai-Hulud supply chain attack
Where is the fbi in this? Why has no one been arrested? This is a massive crime.
Comment on: Keyv and friends compromised in active Shai-Hulud supply chain attack
Can't agree more. I'm working on OSS security tool that can protect you from Shai-hulud, no half measures.The idea is to have a local proxy that injects real secrets into requests in-flight, so a compromised library has nothing to steal because it never had access to any of your secrets: https://github.com/inflightsec/agent-vault-proxy
Comment on: Keyv and friends compromised in active Shai-Hulud supply chain attack
They help only to the extent that you have completely isolated credentials: the hard part isn’t the container, it’s things like fastidiously using separate least-privilege credentials everywhere and not using tools or editor integrations which don’t support that style of work. Once you map your GitHub or AWS token into a container, it’s no longer useful as a security boundary.