4 ms·
Shai Hulud launches second supply-chain attack
- benzible 1y agoDup https://news.ycombinator.com/item?id=46032539 https://news.ycombinator.com/item?id=46032539 [edit: not a dup!]
- swsieber 1y agoThis article has quite a bit more information though.
- dang 1y agoThanks—I've added this link to the toptext at https://news.ycombinator.com/item?id=46032539 https://news.ycombinator.com/item?id=46032539.
- thih9 1y agoNot a dup, this is a different article about the same event, with different information too.
- a4isms 1y agoPlease use the word "Dup" for a resubmission of the same link and "See also" for a different submission.
- neogodless 1y agoSee also: https://news.ycombinator.com/item?id=46032539 https://news.ycombinator.com/item?id=46032539 Shai-Hulud Returns: Over 300 NPM Packages Infected (helixguard.ai) ~6 hours ago | 430 comments
- dang 1y agoOk, we've merged the (relevant) comments thither. Thanks! Edit: Here's a bit of explanation for those curious. Even though the links are different, the test we use for whether to merge threads is whether they are substantially the same story vs. whether the two links will lead to substantially different discussion. In this case it's clear that it's the same discussion, so I merged them. Since the second link has additional information, I've added it to the toptext of the original post. That way people can look at both.
- QuantumNomad_ 1y agoTypo in title. Current title of HN post says: > SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM Should be Shai-Hulud, not SHA1-Hulud.
- adzm 1y agoThat said, the secrets are uploaded to a repo named `Sha1-Hulud: The Second Coming`
- zahlman 1y agoAh, I missed that detail.
- zahlman 1y agoI don't know why you were downvoted. The actual page does not say SHA1, the attack as far as I know is not related to the SHA1 algorithm, and the name of the worm isn't intended as that sort of pun.
- pezezin 1y agoThe worm itself is posting the secrets in Github with the name Sha1-hulud: https://github.com/search?q=sha1-hulud&type=repositories https://github.com/search?q=sha1-hulud&type=repositories
- cyberpunk 1y agoYikes. AWS secrets galore in the couple I decoded (double base64)... I'm surprised github is leaving these up.
- galangalalgol 1y agoAt this point it likely helps the defenders more than those that would use them doesn't it?
- deleted 1y ago[deleted]
- ChrisArchitect 1y ago[dupe] Discussion: https://news.ycombinator.com/item?id=46032539 https://news.ycombinator.com/item?id=46032539
- deleted 1y ago[deleted]
- welder 1y agoPython script to check if any of your repos have the listed compromised packages in pnpm or npm lock files: https://chatgpt.com/s/t_6924b232a8f88191a146a510c6631143 https://chatgpt.com/s/t_6924b232a8f88191a146a510c6631143
- artisin 1y agoWorth mentioning that Bubblewrap[1] (bwrap) can remove most npm/node attack vectors or, at the very least, limit the damage from running arbitrary code during install/execution. Far from a silver bullet, and you'll want to combine it with a simple wrapper script to avoid dinking around with all its arguments, but it beats dealing with rootless Podman containers. [1] https://github.com/containers/bubblewrap https://github.com/containers/bubblewrap
- port11 1y agoThis looks really interesting, but it sounds like it's as complicated to setup as rootless Podman — which is to say not _that_ complicated. Anyone using this with Node or Deno successfully?
- bunnybender 11mo agoFrom my bookmarks (2023): https://news.ycombinator.com/item?id=36686461 https://news.ycombinator.com/item?id=36686461
- port11 11mo agoLovely. Thank you very much!
- splix 1y agoWe made a script to avoid such situations. It checks the dependencies, just by parsing the package.json (or the lock file), checking the relevant time on npm registry, and returns error if it finds a too fresh package added. We run it on CI for each commit/PR, and if a developer tries to commit a change that updates a JS dependency to a too recent it prevents the build from running, and so on. Basically we expect that a Supply Chain attacks on NPM would be noticed in a couple of week, and we enforce this time window to our code. See https://github.com/emeraldpay/paranoid.js https://github.com/emeraldpay/paranoid.js