News for hackers. Stuff that matters.

A comment on Shai-Hulud Returns: Over 300 NPM Packages Infected. Parent comment

Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by silverlight on Monday November 24, 2025 @10:56AM (#46035461)
Did the client side JS being infected produce any issues which would have affected end users? As in if a web owner were on an affected version and deployed during the window would the end user of their site have had any negative impact?
[ Parent | on HN ]
Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by timgl on Monday November 24, 2025 @12:37PM (#46036716)
No, just the host that was running the package (the exploit was pretty generic and not targeted at PostHog specifically). In fact, so far we think there were 0 production deployments of PostHog because the package was only live for a little bit.
[ Parent | on HN ]
Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by silverlight on Monday November 24, 2025 @02:24PM (#46038083)
Glad to hear the impact was so muted. Thank you for the response!
[ Parent | on HN ]