←back to thread

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised

(socket.dev)
1208 points jamesberthoty | 1 comments | 16 Sep 25 11:22 UTC | HN request time: 0.205s | source
Show context
codemonkey-zeta ◴[16 Sep 25 11:56 UTC] No.45261026[source]▶
I'm coming to the unfortunate realizattion that supply chain attacks like this are simply baked into the modern JavaScript ecosystem. Vendoring can mitigate your immediate exposure, but does not solve this problem.

These attacks may just be the final push I needed to take server rendering (without js) more seriously. The HTMX folks convinced me that I can get REALLY far without any JavaScript, and my apps will probably be faster and less janky anyway.

replies(18): >>45261086 #>>45261121 #>>45261140 #>>45261165 #>>45261220 #>>45261265 #>>45261285 #>>45261457 #>>45261571 #>>45261702 #>>45261970 #>>45262601 #>>45262619 #>>45262851 #>>45267210 #>>45268405 #>>45269073 #>>45273081 #
petcat ◴[16 Sep 25 12:03 UTC] No.45261086[source]▶
Rendering template partials server-side and fetching/loading content updates with HTMX in the browser seems like the best of all worlds at this point.
replies(1): >>45261097 #
koakuma-chan ◴[16 Sep 25 12:04 UTC] No.45261097[source]▶
Until you need to write JavaScript?
replies(3): >>45261143 #>>45261161 #>>45261240 #
bdcravens ◴[16 Sep 25 12:19 UTC] No.45261240[source]▶
Then write it. Javascript itself isn't the problem, naive third-party dependencies are.
replies(1): >>45263178 #
pixl97 ◴[16 Sep 25 14:56 UTC] No.45263178[source]▶
Developers are perfectly fine with writing insecure JS all by themselves.
replies(1): >>45283673 #
1. yawaramin ◴[18 Sep 25 01:11 UTC] No.45283673[source]▶
But developers don't typically write malware to deploy on their production systems.