Re:Shai-Hulud Returns: Over 300 NPM Packages Infected
by iknowstuff on Monday November 24, 2025 @12:30PM
(#46036612)
https://fasterthanli.me/articles/i-want-off-mr-golangs-wild-... this article made the rounds here after the author pulled the thread on dependencies in Go
[ Parent
| on HN ]
Re:Shai-Hulud Returns: Over 300 NPM Packages Infected
by jcgl on Thursday November 27, 2025 @10:41AM
(#46070253)
That's pulling on a dependency. An ugly case, but a very specific one relating to a tricky backwards-incompatible change that the Go team fudged on back in the pre-module times.
That story doesn't generally speak to the reality that most Go packages have rather small dependency graphs.