Shai-Hulud Returns: Over 300 NPM Packages Infected

Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by ashishb on Monday November 24, 2025 @01:32PM (#46037347)

Run npm and yarn inside docker [1].

Infact, do this for all risky tools[2]

1 - https://github.com/ashishb/dotfiles/blob/067de6f90c72f0cf849...

2 - https://ashishb.net/programming/run-tools-inside-docker/

[ Parent | on HN ]

Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by anpat on Monday November 24, 2025 @02:39PM (#46038281)

I think it's better to not run npm as root user on container. I would suggest adding --user 1000 to your docker run command.

[ Parent | on HN ]

Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by ashishb on Monday November 24, 2025 @03:04PM (#46038555)

> I think it's better to not run npm as root user on container. I would suggest adding --user 1000 to your docker run command.

Good point. Here's the improvement that work for me

https://github.com/ashishb/dotfiles/commit/fe4fb15fe867bf77a...

[ Parent | on HN ]

Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by jayknight on Monday November 24, 2025 @03:59PM (#46039252)

It gets tricky with private dependencies, then you have to pass some sort of token into the container to authenticate with the host when installing dependencies.

[ Parent | on HN ]

Re:Shai-Hulud Returns: Over 300 NPM Packages Infected by ashishb on Monday November 24, 2025 @04:25PM (#46039528)

Definitely.

Would you prefer doing those tricks or exposing everything on your machine to random npm packages?

[ Parent | on HN ]