News for hackers. Stuff that matters.
Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by iknowstuff on Monday November 24, 2025 @12:30PM (#46036612)
https://fasterthanli.me/articles/i-want-off-mr-golangs-wild-... this article made the rounds here after the author pulled the thread on dependencies in Go
Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by jcgl on Thursday November 27, 2025 @10:41AM (#46070253)
That's pulling on a dependency. An ugly case, but a very specific one relating to a tricky backwards-incompatible change that the Go team fudged on back in the pre-module times.

That story doesn't generally speak to the reality that most Go packages have rather small dependency graphs.