(socket.dev)

1208 points jamesberthoty | 3 comments | 16 Sep 25 11:22 UTC | HN request time: 0.639s | source

A lot of blogs on this are AI generated and such as this is developing, so just linking to a bunch of resources out there:

Socket:

- Sep 15 (First post on breach): https://socket.dev/blog/tinycolor-supply-chain-attack-affect...

- Sep 16: https://socket.dev/blog/ongoing-supply-chain-attack-targets-...

StepSecurity – https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-p...

Aikido - https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-...

Ox - https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hi...

Safety - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack

Phoenix - https://phoenix.security/npm-tinycolor-compromise/

Semgrep - https://semgrep.dev/blog/2025/security-advisory-npm-packages...

Show context

user3939382 ◴[16 Sep 25 12:34 UTC] No.45261383[source]▶

>>45260741 (OP) #

My comment yesterday, which received one downvote and which I will repeat if/until they’re gone: HTTP and JS have to go. There are ways to replace them.

replies(2): >>45261488 #>>45268221 #

1. giveita ◴[16 Sep 25 21:21 UTC] No.45268221[source]▶

>>45261383 #

HTTP?

replies(1): >>45270021 #

2. user3939382 ◴[17 Sep 25 00:20 UTC] No.45270021[source]▶

>>45268221 (TP) #

We have good protocols for sharing programs. HTTP was designed to share stylized documents which it’s OK at. The browser probably should have stuck to rendering and left the p2p file sharing to a better protocol. It absolutely is not fit for the problem domain its been shoehorned into nor does it need to serve that role.

replies(1): >>45270651 #

3. giveita ◴[17 Sep 25 01:53 UTC] No.45270651[source]▶

>>45270021 #

I dont follow. Are you saying the web should be p2p not client server? Or there is something specifically bad about http?

↑

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised