A
Story
Shai Hulud launches second supply-chain attack
Worth mentioning that Bubblewrap[1] (bwrap) can remove most npm/node attack vectors or, at the very least, limit the damage from running arbitrary code during install/execution. Far from a silver bullet, and you'll want to combine it with a simple wrapper script to avoid dinking around with all its arguments, but it beats dealing with rootless Podman containers.

[1] https://github.com/containers/bubblewrap

Python script to check if any of your repos have the listed compromised packages in pnpm or npm lock files:

https://chatgpt.com/s/t_6924b232a8f88191a146a510c6631143

  • ·
  • 13 hours ago
  • ·
  • [ - ]
Dup https://news.ycombinator.com/item?id=46032539 [edit: not a dup!]
  • dang
  • ·
  • 13 hours ago
  • ·
  • [ - ]
Ok, we've merged the (relevant) comments thither. Thanks!

Edit: Here's a bit of explanation for those curious. Even though the links are different, the test we use for whether to merge threads is whether they are substantially the same story vs. whether the two links will lead to substantially different discussion. In this case it's clear that it's the same discussion, so I merged them.

Since the second link has additional information, I've added it to the toptext of the original post. That way people can look at both.

This article has quite a bit more information though.
  • dang
  • ·
  • 13 hours ago
  • ·
  • [ - ]
Thanks—I've added this link to the toptext at https://news.ycombinator.com/item?id=46032539.
Please use the word "Dup" for a resubmission of the same link and "See also" for a different submission.
  • thih9
  • ·
  • 15 hours ago
  • ·
  • [ - ]
Not a dup, this is a different article about the same event, with different information too.
See also: https://news.ycombinator.com/item?id=46032539 Shai-Hulud Returns: Over 300 NPM Packages Infected (helixguard.ai)

~6 hours ago | 430 comments

[dupe] Discussion: https://news.ycombinator.com/item?id=46032539
Typo in title. Current title of HN post says:

> SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

Should be Shai-Hulud, not SHA1-Hulud.

  • adzm
  • ·
  • 15 hours ago
  • ·
  • [ - ]
That said, the secrets are uploaded to a repo named `Sha1-Hulud: The Second Coming`
Ah, I missed that detail.
The worm itself is posting the secrets in Github with the name Sha1-hulud: https://github.com/search?q=sha1-hulud&type=repositories
Yikes. AWS secrets galore in the couple I decoded (double base64)...

I'm surprised github is leaving these up.

At this point it likely helps the defenders more than those that would use them doesn't it?
I am guessing they don't intend to and will be removing them with urgency.
  • ·
  • 13 hours ago
  • ·
  • [ - ]
Also "coming" only has one "m". Or is this some kind of pun?
I don't know why you were downvoted. The actual page does not say SHA1, the attack as far as I know is not related to the SHA1 algorithm, and the name of the worm isn't intended as that sort of pun.