Keyv and friends compromised in active Shai-Hulud supply chain attack

106

ccimi_ about 5 hours ago 42 commentsRead Article on aikido.dev

⚡ Community Insights

Discussion Sentiment

57% Positive

Analyzed from 1020 words in the discussion.

Discussion (42 Comments)Read Original on HackerNews

xnorswap•about 2 hours ago

At this point, any package adding a pre-install hook where there previously was not one should be denied and treated with extreme suspicion.

It's time pre-install / post-install hooks were killed off. Start with a moratorium on any new ones.

jitl•about 2 hours ago

yeah but they can just put the dropper, etc in index.js, so that it runs at import time rather than at install time, no? i guess first-install time is often a privileged developer machine, and will execute in a "server"-like runtime such as Node, Bun, Deno. but blocking preinstall scripts is basic first aid...

jerf•about 2 hours ago

Nobody is claiming this is a complete solution to security. I would call this "necessary but not sufficient". You won't get far as an engineer if you refuse to implement "necessary but not sufficient" changes because the change doesn't in and of itself one-shot the entire problem.

rcxdude•about 1 hour ago

The fact that it's not sufficient also largely means it's not necessary either, because the real solution is auditing and trusting the codebase as a whole. All you do when disabling install hooks is make a lot of situations much more difficult to handle.

csomar•34 minutes ago

These half-measures is why everything has gone to shits. Instead of properly auditing software, reducing the quantity and increasing the quality, we keep pushing more and more garbage where all you find is 2FA that, captcha this, not supported this, app not signed, etc..

insanitybit•about 1 hour ago

Prod tends to have less privileges than CI/CD. CI/CD tends to be full admin, so it's far more sensitive. Prod tends to have tooling for detecting breaches, better logging, etc. People tend to use containers, which act as a sandbox.

Prod also won't be wormable the way that CI/CD is. With CI/CD I can own another dev, use their creds to push another malicious build script, etc. "Attacker is in my prod env" isn't wormable.

Yes, capabilities in prod would be hugely beneficial but removing CI/CD is massive as a win.

JustSkyfall•about 1 hour ago

Wouldn't the dropper get executed once tests are run within CI though?

sysguest•about 1 hour ago

well Deno has the necessary ingredients for defense: file-system permission by path

insanitybit•about 2 hours ago

You'll just end up with people running `./configure` scripts or whatever instead. The solution I've currently landed on is:

1. Audit build scripts/ proc macros for rust code (and mark with cargo-vet).

2. Have an isolated workflow for "build/test/push artifact to temporary place" (s3, github artifact, whatever). No API keys in this workflow.

3. Have another workflow that has the API keys to publish that grabs the artifact and then places it into a registry.

This creates clear separation of "code runs here" and "environment has privileges".

In my own slop-driven programming language I have build scripts declare their capabilities upfront so that you can statically reason about them (same with runtime permissions).

mechazawa•about 2 hours ago

iirc does pnpm not allow them by default. But even if we killed them off there would still be a chance of the malware hooking into something else or only working in cli applications.

mittermayr•about 2 hours ago

Does anyone happen to have a grep or similar that helps me check if this is showing up anywhere in the trillions of files in node_modules (or pnpm store)?

byutifu•about 1 hour ago

This article has a lot of information and ways to check & clean: https://safedep.io/keyv-npm-supply-chain-compromise/

rhdunn•about 2 hours ago

The what happened section mentions the addition of the `setup.mjs` and `Math_Symbol.js`, along with a change in `package.json` to add `"preinstall": "node setup.mjs"`, so presumably checking for any of those would be a good indication to check further.

For example:

    find . -type f | grep -P "/Math_Symbol\.js$"

yread•24 minutes ago

Crucially, Math_Symbol.js that is almost 800KB, not the innocent 1KB one from regenerate-unicode-properties

orheep•about 1 hour ago

find . -type d -name node_modules -prune -exec find {} \( -name setup.mjs -o -name math_init.js -o -name Math_Symbol.js \) \; 2>/dev/null

codeduck•about 1 hour ago

Oh boy, it's a big one.

TacticalCoder•about 1 hour ago

> Oh boy, it's a big one.

Yup the "Update" in TFA is scary:

"Update — August 4, 2026, 13:37 CEST: At least 434 packages (across 1381 versions) have been compromised by the worm, with a combined total of over 2 billion monthly installs at the time of writing."

Lots of pain ahead.

somebudyelse•21 minutes ago

the irony of the update being at 1337

avaer•about 3 hours ago

I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous.

Surely Github's software is good enough that an intern can slop the 80/20 together in a day? It would be an actually good use of AI spending.

abhisek•about 2 hours ago

GitHub announced this a while back:

https://github.blog/changelog/2026-07-28-npm-publish-time-ma...

hulitu•about 2 hours ago

> I am kind of surprised GitHub doesn't seem to have built a simple classifier for public repos to proactively lock the account of anyone uploading such obviously fishy things (for their own good, at least before the repo is publicly findable), so it can't be used as a rendezvous.

Maybe that's the idea. Regards, the <insert your favourite 3 letter agency here>

Catloafdev•24 minutes ago

I mean what are these devs doing that they are day-1 updating npm packages still?

How many instances of this are required before npm package maintainers learn?

ethanwillis•about 1 hour ago

You know with all this AGI swirling around nowadays that is stronger than nation state hackers you think one of these companies would demonstrate just how capable they are by defending public infrastructure.

Unless...

Maybe in 6 months.

cute_boi•about 1 hour ago

I think npm can use chatgpt/claude for each published package to detect these types of attack? And if it sees they can restrict the package from making any changes.

wolfi1•about 1 hour ago

the remedy is worse than the disease

thinkingemoji•41 minutes ago

No way to prevent this says only package manager where this regularly happens

insanitybit•4 minutes ago

This is the most boring comment posted on every one of these. NPM is by no means the worst offender here and offers a ton of solutions to this, lots of package managers are behind it or equivalent.

NPM gets targeted a lot because it's popular. That's it.

ftlps•about 2 hours ago

aikido.dev: SAST, AI code analysis and therefore a website that uses 100% CPU and prevents scrolling.

To the point of the article: I don't know why GitHub still allows the release feature. It is complete insanity. Tar archives must be constructed manually and checked for leaked keys etc.

tgv•about 2 hours ago

I got the news via https://safedep.io/keyv-npm-supply-chain-compromise/

vlovich123•about 3 hours ago

> Update — August 4, 2026, 13:37 CEST: At least 868 packages (across 1381 versions) have been compromised by the worm, with a combined total of over 2 billion monthly installs at the time of writing.

This is such lazy or click baiting writing. Who cares how many installations there are per month normally? The high install numbers are almost certainly from running in CI where such secrets don’t exist. How many installs actually occur in a non CI environment and of those how many were the compromised version?

insanitybit•about 2 hours ago

> almost certainly from running in CI where such secrets don’t exist.

CI usually has the most privileged secrets anywhere in a company lol

TeMPOraL•about 2 hours ago

CIs having per-package installs : version ratio > 1 are fundamentally dumb idea in the first place.

In a way, this teaches us that there is something as too much reliability in an ecosystem. Specifically, Github is apparently reliable enough that its occasional outages are insufficient to kill all the companies running these dumb CI setups that redownload packages from the Internet every build - so there's no incentive to reduce waste and improve security globally.

rcxdude•about 1 hour ago

Redownloading and automatically updating to the new version are pretty orthogonal. You can have a solution which caches the packages but would still update to a new version or a solution which redownloads the (verifiably) same package each time. Vendoring libraries stops both but it's the automatic updates which are the biggest risk factor.