←back to thread

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

(socket.dev)
1208 points jamesberthoty | 1 comments | 16 Sep 25 11:22 UTC | HN request time: 0.267s | source
Show context
philipwhiuk ◴[16 Sep 25 12:07 UTC] No.45261128[source]▶
post-install seems like it shouldn't be necessary anyway, let alone need shell access. What are legitimate JS packages using this for?
replies(4): >>45261294 #>>45261367 #>>45261717 #>>45262695 #
1. homebrewer ◴[16 Sep 25 12:24 UTC] No.45261294[source]▶
From what I've seen, it's either spam, telemetry, or downloading prebuilt binaries. The first two are anti-user and should not exist, the last one isn't really necessary — swc, esbuild, and typescript-go simply split native versions into separate packages, and install just what your system needs.

Use pnpm and whitelist just what you need. It disables all scripts by default.