Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by otterley on Sunday December 14, 2025 @02:58PM (#46266251)

Typical defense against this is to mount all user-writable filesystems as `noexec` but unfortunately most OSes don't do that out of the box.

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by mr_mitm on Sunday December 14, 2025 @03:05PM (#46266318)

It could have created a bash alias then. And I don't think a dev wants to be restricted in creating executables. Again, if a dev can do it, so can the malware.

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by dividuum on Sunday December 14, 2025 @04:46PM (#46267314)

I remember you could trivially circumvent that with „/lib/ld-linux.so <executable>“. Does that no longer work?

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by lights0123 on Sunday December 14, 2025 @10:34PM (#46270141)

noexec now prevents mmaping files on that filesystem as executable.

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by LtWorf on Sunday December 14, 2025 @06:58PM (#46268539)

Kinda hard to work as a software developer then.

[ Parent | on HN ]