←back to thread

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

(socket.dev)

1208 points jamesberthoty | 3 comments | 16 Sep 25 11:22 UTC | HN request time: 0.001s | source

A lot of blogs on this are AI generated and such as this is developing, so just linking to a bunch of resources out there:

Socket:

- Sep 15 (First post on breach): https://socket.dev/blog/tinycolor-supply-chain-attack-affect...

- Sep 16: https://socket.dev/blog/ongoing-supply-chain-attack-targets-...

StepSecurity – https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-p...

Aikido - https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-...

Ox - https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hi...

Safety - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack

Phoenix - https://phoenix.security/npm-tinycolor-compromise/

Semgrep - https://semgrep.dev/blog/2025/security-advisory-npm-packages...

1. whatever1 ◴[17 Sep 25 11:51 UTC] No.45274665[source]▶

>>45260741 (OP) #

Isn’t this a good case for LLMs? Audit at compile time all of the dependencies?

replies(1): >>45274911 #

2. huem0n ◴[17 Sep 25 12:14 UTC] No.45274911[source]▶

>>45274665 (TP) #

Please no, see

> Using CVE reports as a weapon

https://www.youtube.com/watch?v=GDdlRiThDeg

replies(1): >>45275872 #

3. whatever1 ◴[17 Sep 25 13:52 UTC] No.45275872[source]▶

Oh you took it further, let the LLM take the wheel. I was just referring to the LLM raising a red flag during compilation. So worst case scenario it will just raise a false positive.