Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

(socket.dev)

1208 points jamesberthoty | 3 comments | 16 Sep 25 11:22 UTC | HN request time: 0s | source

A lot of blogs on this are AI generated and such as this is developing, so just linking to a bunch of resources out there:

Socket:

- Sep 15 (First post on breach): https://socket.dev/blog/tinycolor-supply-chain-attack-affect...

- Sep 16: https://socket.dev/blog/ongoing-supply-chain-attack-targets-...

StepSecurity – https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-p...

Aikido - https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-...

Ox - https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hi...

Safety - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack

Phoenix - https://phoenix.security/npm-tinycolor-compromise/

Semgrep - https://semgrep.dev/blog/2025/security-advisory-npm-packages...

Show context

homebrewer ◴[16 Sep 25 12:14 UTC] No.45261199[source]▶

>>45260741 (OP) #

When the left-pad debacle happened, one commenter here said of a well known npm maintainer something to the effect of that he's an "author of 600 npm packages, and 1200 lines of JavaScript".

Not much has changed since then. The best counter-example I know is esbuild, which is a fully featured bundler/minifier/etc that has zero external dependencies except for the Go stdlib + one package maintained by the Go project itself:

https://www.npmjs.com/package/esbuild?activeTab=dependencies

https://github.com/evanw/esbuild/blob/755da31752d759f1ea70b8...

Other "next generation" projects are trading one problematic ecosystem for another. When you study dependency chains of e.g. biomejs and swc, it looks pretty good:

https://www.npmjs.com/package/@biomejs/biome/v/latest?active...

https://www.npmjs.com/package/@swc/types?activeTab=dependenc...

Replacing the tire fire of eslint (and its hundreds to low thousands of dependencies) with zero of them! Very encouraging, until you find the Rust source:

https://github.com/biomejs/biome/blob/a0039fd5457d0df18242fe...

https://github.com/swc-project/swc/blob/6c54969d69551f516032...

I think as these projects gain more momentum, we will see similar things cropping up in the cargo ecosystem.

Does anyone know of other major projects written in as strict a style as esbuild?

replies(6): >>45261429 #>>45261662 #>>45261809 #>>45264078 #>>45267771 #>>45267783 #

benmccann ◴[16 Sep 25 13:14 UTC] No.45261809[source]▶

>>45261199 #

Yes, eslint is particularly frustrating: https://npmgraph.js.org/?q=eslint

There are plenty of people in the community who would help reduce the number of dependencies, but it really requires the maintainers to make it a priority. Otherwise the only way to address it is to switch to another solution like oxlint.

replies(2): >>45262741 #>>45274220 #

dmix ◴[16 Sep 25 14:29 UTC] No.45262741[source]▶

>>45261809 #

I tried upgrading ESLint recently and it took me forever to fix all the dependency issues. I wish I never used ESLint prettier as now my codebase styling is locked into an ESLint config :/

replies(2): >>45263269 #>>45264063 #

azemetre ◴[16 Sep 25 15:01 UTC] No.45263269[source]▶

>>45262741 #

Have you looked into biome? We recently switched at work. It’s fine and fast. If you overly rely on 3rd party plugins it might be hard but it covered our use case fine for a network based react app.

Way less dependencies too.

replies(1): >>45264459 #

1. dmix ◴[16 Sep 25 16:30 UTC] No.45264459[source]▶

>>45263269 #

Even minor styling rule changes would result in a huge PR across our frontend so I tend to avoid any change in tooling. But using old tools is not the end of the world. I only upgrade ESLint because I had to upgrade something else.

replies(1): >>45264987 #

2. adhamsalama ◴[16 Sep 25 17:10 UTC] No.45264987[source]▶

>>45264459 (TP) #

Would omitting this commit from git blame solve the issue?

replies(1): >>45265933 #

3. dmix ◴[16 Sep 25 18:26 UTC] No.45265933[source]▶

>>45264987 #

Oh that's a great idea. I forgot about git --ignore-revs

↑