News for hackers. Stuff that matters.

A comment on Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem.

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by sync on Sunday December 14, 2025 @09:36AM (#46263306)
That’s weird, pnpm no longer automatically runs lifecycle scripts like preinstall [1], so unless they were running a very old version of pnpm, shouldn’t they have been protected from Shai-Hulud?

1: https://github.com/pnpm/pnpm/pull/8897

[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by ItsHarper on Sunday December 14, 2025 @10:24AM (#46263692)
At the end of the article, they talk about how they've since updated to the latest major version of pnpm, which is the one with that change
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by pverheggen on Sunday December 14, 2025 @10:19AM (#46263650)
Maybe the project itself had a postinstall script? It doesn't run lifecycle scripts of dependencies, but it still runs project-level ones.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by e40 on Sunday December 14, 2025 @09:55AM (#46263459)
Yeah, I thought that was the main reason to use pnpm. Very confused.
[ Parent | on HN ]
Re:Shai-Hulud compromised a dev machine and raided GitHub or... by agilob on Sunday December 14, 2025 @02:14PM (#46265859)
Let me understand it fully. That means they updated dependencies using old, out of date package manager. If pnpm was up to date, this would no have happened? Sounds totally like their fault then
[ Parent | on HN ]