SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by JadoJodo on Monday November 24, 2025 @12:09PM (#46036330)

Would the adoption of a Deno-like security posture in NPM have mitigated this?

[ Parent | on HN ]

Re:SHA1-Hulud the Second Comming – Postman, Zapier, PostHog ... by jkrems on Monday November 24, 2025 @01:04PM (#46037025)

pnpm is the better comparison maybe in this context. Most of Deno's approach to security is focussed on whole program policies which doesn't do much in this context. Just like pnpm and others, they do have opt-in for install scripts though. The npm CLI is an outlier there by now.

[ Parent | on HN ]