32 ms·
Post-mortem of Shai-Hulud attack on November 24th, 2025
- flunhat 10mo agoPosthog's website design feels like a joke that went a bit too far
- anonymous908213 10mo agoOther than the silly design, the website's cookie banner is actively malicious. It proclaims to be legally required and directly blames the President of the European Commission. If Posthog is being truthful about its cookie usage, the cookie banner is in fact not legally required. Consent banners are only required if you're trying to do individual user tracking or collecting personally identifying data; technical cookies like session storage do not require a banner. That they then chose to include a cookie banner anyways, with explicit blame, is an act of propaganda clearly intended to cause unnecessary consent banner fatigue and weaken support for the GDPR.
- dkdcio 10mo agoI agree it’s stupid but wouldn’t ascribe intent without more information
- vanschelven 10mo agoI don't have a cookie banner on _my_ website for exactly this reason, but I have to admit some people have asked my if it isn't suspicious that I don't. Perhaps that's what they're trying to avoid here? (that would be the positive reading)
- lotyrin 10mo agoMaybe you need a "why I don't have a banner" banner.
- vanschelven 10mo agoI think that's what Posthog might be trying but as per the above there may be a fine line between funny and annoying and/or between useful and useless. or maybe I just missed your sarcasm
- jwpapi 10mo agoThey made a post how they reinvented ux
- krater23 10mo agookay, now I think this is really a joke. A website where it's not possible to scroll with the keyboard is telling us something about ux.
- amitav1 10mo agoPlease don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- flunhat 10mo agoSurely we can make an exception when it's this egregious? Like all rules, there are exceptions.
- fatty_patty89 10mo agoSecond time you posted this, are you a moderator?
- krater23 10mo agoIt not only feels like, scrolling with keyboard is not possible. This is a joke.
- mrdosija 10mo agoSo it wasn't phishing attack? Wonder how those bot access tokens got stolen.
- jameskilton 10mo ago> The PR was opened, the workflow run, and the PR closed within the space of 1 minute (screenshots include timestamps in UTC+2, the author's timezone): It's an unfortunately common problem with GitHub Actions, it's easy to set things up to where any PR that's opened against your repo runs the workflows as defined in the branch. So you fork, make a malicious change to an existing workflow, and open a PR, and your code gets executed automatically. Frankly at this point PRs from non-contributors should never run workflows, but I don't think that's the default yet.
- LtWorf 10mo agoProblem is that you might want to have the tests run before even looking at it. I think the mistake was to put secrets in there and allow publishing directly from github's CI. Hilariously the people at pypi advise to use trusted publishers (publishing on pypi from github rather than local upload) as a way to avoid this issue. https://blog.pypi.org/posts/2025-11-26-pypi-and-shai-hulud/ https://blog.pypi.org/posts/2025-11-26-pypi-and-shai-hulud/
- mulmboy 10mo agoIt does largely avoid the issue if you configure to allow only specific environments AND you require reviews before pushing/merging to branches in that environment. https://docs.pypi.org/trusted-publishers/adding-a-publisher/ https://docs.pypi.org/trusted-publishers/adding-a-publisher/ For a malicious version to be published would then require full merge which is a fairly high bar. AWS allows similar
- LtWorf 10mo agoAs we're seeing, properly configuring github actions is rather hard. By default force pushes are allowed on any branch.
- hhh 10mo agoI didn’t know what Posthog was before this event but the website is so unusable on Safari on MacOS or iOS for me i’m surprised I stuck through to discover the product.
- flunhat 10mo agoCurious, I pressed "X" on the blog post. It went away, leaving me with the fake desktop view at "posthog.com". Ok, fine. How do I get back? I pressed the back button on my browser. The URL updated to be the blog post's URL. A good start. But the UI did not change, leaving me at the desktop view. Many moments like these if you use Posthog
- deleted 10mo ago[deleted]
- deleted 10mo ago[deleted]
- zahlman 10mo agoWithout JavaScript, all I get is a background image and a top "navigation bar" where the only thing that's actually operable at all is a signup link. Which then goes to a completely blank page. I still don't know what Posthog is, but I'm now committed to never using it if I can at all help it.
- mbreese 10mo agoWe are taking about a company’s JavaScript libraries (the npm attack). Knowing that, I’m pretty sure that people who browse without JavaScript enabled aren’t their target market. I’m apparently also not in their market so, the best I ca say from the website is (hand wavy) “website analytics”.
- khannn 10mo agoThe site caused my browser to freeze and it reminded me of the 56k modem days.
- 10mo ago
- woodruffw 10mo agoThis is a great writeup, kudos for the PostHog folks. Curious: would you be able to make your original exploitable workflow available for analysis? You note that a static analysis tool flagged it as potentially exploitable, but that the finding was suppressed under the belief that it was a false positive. I'm curious if there are additional indicators the tool could have detected that would have reduced the likelihood of premature suppression here. (I tried to search for it, but couldn't immediately find it. I might be looking in the wrong repository, though.)
- helpfulrobot 10mo agoHere's the PR that introduced the vulnerability: https://github.com/PostHog/posthog/pull/37915 https://github.com/PostHog/posthog/pull/37915
- duck2 10mo agoIt's a bit funny the vuln was introduced by someone with the username "haacked"
- KomoD 10mo agoWow, I hate this website to be honest. So much of the space is taken up by all these "bars" on my already small screen.
- tomhow 10mo agoPlease don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- themly 10mo agoLong story short: they messed up the assign-reviewers.yml workflow, allowing external contributors to merge PRs without proper reviews. From this point on, you're fully open to all kinds of bad stuff.
- vanschelven 10mo agomore so in case you actually do the "secrets on github with the right to do meaningful things"
- meowface 10mo agoYeah that's a pretty deadly combo.
- ivanjermakov 10mo agoOpener source software
- dreamcompiler 10mo agoHere's an AI product I would actually use: Write my damn GH actions yml for me. Oh, and describe for me exactly how it works and why. And be right about it.
- fragmede 10mo agoWhy does it need to be a distinct product and not Cursor/ChatGPT/Claude code/any of the other existing tools? (If you're so anti-AI that you're still writing boilerplate like that by hand, I mean, not gonna tell you what you do, but the rest of us stopped doing that crap as soon as it was evident we didn't have to any more.)
- slashdave 10mo agoExcept the model would have been trained on the available corpus of known runners and will achieve the same average level of quality...
- codesparkle 10mo ago
- deleted 10mo ago[deleted]
- deleted 10mo ago[deleted]
- healsdata 10mo agoImagine my surprise that the company that posts "Collaboration sucks" and endorses a YOLO approach to decision making then has a security breach based on misconceptions of a GitHub action that was caught by security tools and could have been proven out via collaboration or a metered approach to decision making.
- __d 10mo agoSo I saw the headline and for a moment I was very confused: aren’t sand worms fictional? Pre-coffee, apparently.
- erikpukinskis 10mo agoDoes anyone have experience putting their production branches in a separate repo from their development branches? GitHub makes it very easy to make a pull request from one repo into another. This would seem to have a lot of benefits: you can have different branch protection rules in the different repos, different secrets. Would it be a pain in the ass? For an open source project you could have an open contribution model, but then only allow core maintainers to have write access in the production repo to trigger a release. Or maybe even make it completely private.
- jhealy 10mo agoAt a previous employer we did this with our docs repo. The public docs site was managed and deployed via a private GitHub repository, and we had a public GitHub repo that mirrored it. The link between them was an action on the private repo that pushed each new man commit to the mirror. Customer PRs on the public mirror would be merged into the private repo, auto synced to the mirror, and GH would mark the public PR as merged when it noticed the PR commits were all on main. It was a bit of a headache, but worked well enough once stag involved in docs built up some workflow conventions. The driver for the setup was the docs writers want the option to develop pre-release docs discretely, but customer contributions were also valued.
- deleted 10mo ago[deleted]
- dangoodmanUT 10mo agoThe slight side scrolling on mobile, and overriding the link alt-click behavior… why
- hardwaresofton 10mo agoDear everyone. Never use pull_request_target. This is not the first time it’s bitten people. It’s not safe, and honestly GitHub should have better controls around it or remove and rework it — it is a giant footgun. > One of our engineers figured out this was because it triggered on: pull_request which means external contributions (which come from forks, rather than branches in the repo like internal contributions) would not have the workflow automatically run. The fix for this was changing the trigger to be on: pull_request_target, which runs the workflow as it's defined in the PR target repo/branch, and is therefore considered safe to auto-run.
- amluto 10mo agoDear GitHub Actions: what the heck? There are so many things about GitHub Actions that make no sense. Why are actions configured per branch? Let me configure Actions somewhere on the repository that is not modifiable by some yml files that can exist in literally any branch. Let me have actual security policy for configuring Actions that is separate from permission to modify a given branch. Why do workflows have such strong permissions? Surely each step should have defined inputs (possibly from previous steps), defined outputs, and narrowly defined permissions. Why can one step corrupt the entire VM for subsequent steps? Why is security almost impossible to achieve instead of being the default? Why does the whole architecture feel like someone took something really simple (read a PR or whatever, possibly run some code in a sandbox, and produce an output) of the sort that could easily be done securely in JavaScript or WASM or Lua or even, sigh, Docker and decided to engineer it in the shape of an enormous cannon aimed directly at the user’s feet?
- nine_k 10mo agoA way to determine a workflow per branch, inside the branch, is useful for developing workflows. But it's perilous in other circumstances. I wish I could, at the repo level, disable the use of actions from ./.github, and instead name another repo as the source of actions. This could be achieved by defining a pre-merge-commit hook, and reject commits that alter protected parts of the tree. This would also require extra checks on the action runnes side.
- 10mo ago
- wat10000 10mo agoI was expecting this to be some sort of bizarre Dune satire.
- hrpnk 10mo agoTIL: yarn/pnpm has a minimumReleaseAge setting. "We also suggest you make use of the minimumReleaseAge setting present both in yarn and pnpm. By setting this to a high enough value (like 3 days), you can make sure you won't be hit by these vulnerabilities before researchers, package managers, and library maintainers have the chance to wipe the malicious packages."
- joatmon-snoo 10mo agoThis setting is new and was introduced in response to the first round of shai hulud attacks.
- butz 10mo agoSo, did GitHub's "plan for a more secure npm supply chain" failed?