This May Be the Worst One  ## Metadata - Author: [[ThePrimeTime]] - Full Title: This May Be the Worst One - Category: #articles - Document Note: --- tags: [Assign relevant tags or keywords to the notee to facilitate organization and retrieval. Add a # before each tag. Tags cannot have special characters. Do not use the tag #articles] - #supplychain - #npm - #security Author: YouTube creator (channel not specified in transcript) Source: YouTube video (transcript) Reference: https://www.youtube.com/watch?v=69F9IuBWb-E date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} --- # 🪱 Title: “This May Be the Worst One” — Shai-Hulud npm Worm & Supply-Chain Lessons ## 🧭 Table of Contents: - 🔗 [📝 Summary](#-summary) - 🔗 [📖 Main Content](#-main-content) - 🔗 [🗒️ Notes — Timestamped Subheadings (Clickable to YouTube)](#️-notes--timestamped-subheadings-clickable-to-youtube) - 🔗 [📖 References](#-references) - 🔗 [🗣️ Paraphrase](#-paraphrase) - 🔗 [📰 Newsletter](#-newsletter) - 🔗 [✅ Action Items](#-action-items) - 🔗 [🧪 Hypotheses](#-hypotheses) - 🔗 [📊 Methodology](#-methodology) - 🔗 [❓ Questions](#-questions) - 🔗 [🔮 Future Research](#-future-research) - 🔗 [💡 Implications](#-implications) - 🔗 [🧠 Learning Styles Assessment](#-learning-styles-assessment) - 🔗 [📊 Accessibility Assessment](#-accessibility-assessment) - 🔗 [🌍 DEIB Assessment](#-deib-assessment) - 🔗 [✅ Logical Validity & Tone](#-logical-validity--tone) - 🔗 [🛡️ DARVO Analysis](#-darvo-analysis) - 🔗 [🔍 SEO Evaluation](#-seo-evaluation) - 🔗 [🎯 Conclusion](#-conclusion) ### 📚 References: Include a list of sources consulted and cited in the article. - 🔗 Primary: Video transcript — https://www.youtube.com/watch?v=69F9IuBWb-E - 🔗 Mentioned concepts/tools: TruffleHog, GitHub Actions, post-install scripts, semantic-versioning (no external sources cited in the video) --- ## 📝 Summary: - 🪱 A worm-style npm attack (“Shai-Hulud”) propagated repo-to-repo by stealing tokens and mutating CI to push malicious patch versions. - 🔒 The presenter stresses version pinning, smaller dependency trees, and CI/token hardening as practical defenses. - 🧪 The attack abused post-install scripts and secret-scanning tooling to exfiltrate credentials, then auto-republished. - 🧱 Even careful teams can be exposed through floating transitive dependencies. --- ## 📖 Main Content: - 🧠 **Threat model shift:** Not just “user installs a bad package.” The worm targets maintainers and CI to **manufacture** more bad packages. - 🧰 **Technique stack:** Post-install runner → secrets scanner abuse → token capture → GH Actions edits → publish wormed patch versions. - 🧱 **Amplifiers:** Auto-upgrade ranges (`^`/`~`), dormant packages revived with tiny version bumps, and long-lived CI tokens. - 🧯 **Defensive stance:** Pin versions; whitelist or block post-install; rotate to short-lived tokens; restrict CI permissions; prune trivial dependencies. --- ## 🗒️ Notes — Timestamped Subheadings (Clickable to YouTube) ### 🔥 [0:00–0:10 • Third npm incident in a week (hook)](https://www.youtube.com/watch?v=69F9IuBWb-E&t=0s) - 🧷 Sets urgency: “How is this still happening?” Repetition primes risk awareness. - 🧭 Frames topic: supply-chain attacks as a recurring systemic failure. ### 🪙 [0:16–0:33 • “Shai-Hulud” name & Dune riff](https://www.youtube.com/watch?v=69F9IuBWb-E&t=16s) - 🧩 “Tokens must flow” gag connects theme: tokens as the attack’s currency. - 🎭 Humor lowers the shield while keeping focus on credential theft. ### 🧬 [0:31–1:18 • Why this one is worse: lateral spread](https://www.youtube.com/watch?v=69F9IuBWb-E&t=31s) - 🦠 Not only exfiltration; it **self-propagates** repo→repo via CI mutation. - 🧰 Blends multiple attack modes: phishing + worming + supply-chain tampering. ### 🎣 [1:21–1:40 • Likely phishing origin](https://www.youtube.com/watch?v=69F9IuBWb-E&t=81s) - 🧵 Initial foothold from a smaller repository compromise. - 💤 Dormant package revived; audience warned about “long-quiet” packages. ### 🧪 [1:40–1:58 • Malicious patch bumps (0.0.5 / 0.0.6)](https://www.youtube.com/watch?v=69F9IuBWb-E&t=100s) - 🧨 Tiny semver changes smuggle the payload. - 🧭 Lesson: treat patch bumps as untrusted until reviewed. ### 🔒 [2:01–2:25 • “Do not auto-upgrade patch versions”](https://www.youtube.com/watch?v=69F9IuBWb-E&t=121s) - 🧱 Floating ranges widen your blast radius. - 🔁 Even if you pin, upstreams can still float; transitive risk remains. ### ⚙️ [2:47–3:06 • Dependency automation critique](https://www.youtube.com/watch?v=69F9IuBWb-E&t=167s) - 🛑 Over-automation without review ≈ “walking into hell.” - 🧮 Policy hint: favor manual promotion + release note checks. ### 🧰 [3:07–3:19 • Post-install again, but different payload](https://www.youtube.com/watch?v=69F9IuBWb-E&t=187s) - 🧪 Compares to prior NX incident; similar vector, new behavior. ### 🕵️ [3:29–3:41 • TruffleHog abuse](https://www.youtube.com/watch?v=69F9IuBWb-E&t=209s) - 🐗 Legit secret scanner repurposed for credential harvesting. - 🧷 Reminder: dual-use tools require context-aware controls. ### 🧵 [4:01–4:21 • CI pivot: mutate GitHub, republish](https://www.youtube.com/watch?v=69F9IuBWb-E&t=241s) - 🧪 Edits GH Actions, injects post-install, publishes infected patches. - 🧱 Turns victims into amplifiers across the dependency graph. ### 🖥️ [4:36–4:50 • Workstations and CI both at risk](https://www.youtube.com/watch?v=69F9IuBWb-E&t=276s) - 🔑 Any environment holding tokens becomes an entry point. - 🔒 Emphasizes token scope, rotation, and short lifetimes. ### 📈 [4:52–5:12 • From ~40 to ~180 packages (fast growth)](https://www.youtube.com/watch?v=69F9IuBWb-E&t=292s) - 🧮 Uses hyperbole (“24B”) as a joke; still signals exponential spread. - 🧭 Practical read: watch for fast-moving advisories and revoke early. ### 🏢 [5:12–5:25 • Ironic vendor infections](https://www.youtube.com/watch?v=69F9IuBWb-E&t=312s) - 🎭 Irony aside, message is clear: **no one** is exempt from process debt. ### 🎨 [5:47–6:12 • @ctrl/tinycolor versions flagged](https://www.youtube.com/watch?v=69F9IuBWb-E&t=347s) - 🧪 “4.11 / 4.12 bad; 4.20 safe” per presenter’s riff. - 🧭 Action: verify advisories; don’t trust hearsay—check your lockfile. ### 🪓 [6:15–6:37 • Fewer dependencies thesis](https://www.youtube.com/watch?v=69F9IuBWb-E&t=375s) - 🧰 For single-function needs, write a vetted snippet. - 🧱 Shrink attack surface; reduce transitive surprises. ### 🤖 [6:34–7:02 • AI can generate simple utilities](https://www.youtube.com/watch?v=69F9IuBWb-E&t=394s) - 🧪 Use with review and tests; don’t trade one risk for another. - 🧭 Codify a checklist before adopting AI-generated code. ### 🤝 [7:00–7:16 • Collective security responsibility](https://www.youtube.com/watch?v=69F9IuBWb-E&t=420s) - 🧱 You pinning isn’t enough if upstreams float. - 🧭 Ecosystem norms matter: SBOMs, attestations, policy. ### 🎬 [7:16–end • Tone & sign-off](https://www.youtube.com/watch?v=69F9IuBWb-E&t=436s) - 🎭 Satirical closer (“I use Elixir”) to keep energy high. - 📣 Call to engage; implicit nudge toward shared security culture. --- ## 📖 References: - 🔗 Video transcript: https://www.youtube.com/watch?v=69F9IuBWb-E - 📝 In-video mentions (no external cites provided): TruffleHog, GitHub Actions, @ctrl/tinycolor, NX incident, post-install scripts --- ## 🗣️ Paraphrase: - 🧩 **Version discipline, reworded:** Treat patch bumps as hostile until proven safe. Float nothing on build paths. Promote with human review and clear provenance. - 🧯 **Dependency minimalism, reworded:** For small utilities, a well-tested local function beats a heavy package. Fewer deps mean fewer places for worms to hide. --- ## 📰 Newsletter: - 🪱 **npm’s Shai-Hulud worm:** A repo-to-repo spread used post-install and CI token abuse to publish malicious patch versions at speed. - 🔧 **Fix it fast:** Pin versions, rotate tokens, lock down GH Actions, and prune trivial deps. Add SBOM + provenance to your release checklist. - 🧭 **For WordPress builders:** If Node sits in your build chain, treat it like prod—deny unvetted post-install, require reviews, and track transitive risk. - 🎥 Watch: https://www.youtube.com/watch?v=69F9IuBWb-E --- ## ✅ Action Items: - 🔒 **Pinning policy:** Enforce exact versions for build-time deps; block `^`/`~` in CI for production paths. - 🗝️ **Token hygiene:** Rotate all PATs; move to short-lived OIDC; least privilege on publish - Summary: https://twitch.tv/ThePrimeagen - I Stream 5 days a Week Become A Great Backend Dev: https://boot.dev/prime (I make courses for them) This is also the best way to support me is to support yourself becoming a better backend engineer. https://twitter.com/terminaldotshop - Order coffee over SSH! ssh terminal.shop Discord: https://discord.gg/ThePrimeagen ### LINKS https://www.npmjs.com/package/@ctrl/tinycolor https://thehackernews.com/2025/09/40-npm-packages-compromised-in-supply.html https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hit-in-major-supply-chain-attack/ Great News? Want me to research and create video????: https://www.reddit.com/r/ThePrimeagen Kinesis Advantage 360: https://bit.ly/Prime-Kinesis - URL: https://www.youtube.com/watch?v=69F9IuBWb-E I don't understand how this keeps happening. How are we here? Three times in a single week. Yes, another supply chain attack happened again on npm. And yes, a lot and a lot of repositories were affected. Now, this one code named Shy Halude. Obviously, the tokens must flow. Okay, the tokens. Just give me the tokens. There are so many twists to this one. This one is an absolute masterclass in just destroying an ecosystem. Now what makes Shy Hulu different here is that instead of just simply being something in which the end user ends up downloading an npm package and then what the post install script goes and takes all your credentials and like I got your tokens. Yes. Yes. Instead, it doesn't just do that. It spreads itself from repository to repository to repository and just keeps on growing. So, this isn't just simply a fishing attack. It's like all the attacks in one. Also, very impressive that it's the Singularity NX hack that happened just last week. This appears to be by the same crew. Okay, they're on a they're on a hacking spree. Okay, this is a this is a double hack. I mean, they might even get to a triple hack potentially. A a hacktacular is on the horizon. All right, let's just jump right into it. So, how did this hack happen again? Now, first off, it likely occurred due to a fishing scam. That's what everything is saying. I asked Grock to find some sources. It just appears that fishing was the root cause. Some small repository got had. The unknown repository is likely this uh RX NT authentication, which has been deprecated, hasn't seen any publications for a long time. Then out of nowhere 4 days ago got a new version which was going to be 005 which it looks like it's been removed already and 006 which both contained this attack. Now the attack took advantage of the exact same thing again a little patch version update. Now I don't know why this keeps happening. I swear I keep saying this. Don't autoupgrade patch versions. It's like a massive security vulnerability. This is like the easiest way to be had ever yet it just keeps happening. Why? Why do you keep doing it? Say no. Lock your versions. Now obviously this is really really difficult because you may lock your versions and you may be the good you know the good citizen in this situation. But remember package managers are in fact evil and people who don't lock their versions can still get you because you rely on them. They rely on other things. those other things get, you know, supply chain attacked. Boom. It trickles all the way down to you despite the fact that you did all the right steps. And Ginger Bill maybe is right. Maybe Ginger Bill is correct. Automation of package dependencies is walking into hell and we should all avoid it as much as we possibly can. I don't know. Maybe he is right. Mr. Quantum mechanic scientist who moonlights as language creator. Anywh who, so after the patch version has been installed, a post install script again gets installed and this time instead of using like say the AI to go through your system and get all the credentials, which is what happened last time with the NX attack, which by the way was just a couple days ago. Okay, no sleep for the weary here. We just got to go from one attack to the next attack. This one instead uses something called Truffle Hog, which by the way, insane name. Old girl, I'm going to slip my truffle hog on that computer and I'm going to get so many tokens you don't even know. A truffle hog is like a secret scanning tool. You're supposed to use it on your repository or use it in CI to make sure you're not accidentally leaking tokens. So like its idea is actually good. Unless if someone uses it for not good, then it's bad. Then it's really bad. So anyways, after getting your tokens, so this is where the things take a turn. So unlike the previous one and all unlike most of these attacks which take your tokens and then throws them all up onto a repository and it's like talk about all your tokens. This time instead just immediately goes to work on your GitHub. Oh, we're going to update some CI. We're going to put in some new post installation. We're going to publish to npm. It does all the things to attempt to go publish patch versions with its new installation process that has the post install that does and does it again. So that way if one unknown repository gets had during CI of the next one, it goes d and just get just it's just flying through the system. That means you're vulnerable on your desktop if you have tokens that can be taken advantage of. That means your CI is vulnerable if your CI has the tokens that can be taken advantage of. Now hide like literally hide your kids, hide your wives, hide your husband because they're stealing everybody's tokens out here. So, as this thing has progressed, it started off with 40 npm packages that have been compromised. Now, it's up to 180. This is only just a few hours later. My guess is that by the end of the week, it'll be like 24 billion just by the growth rate here. I want to take a look at who got affected because as you can see, there's just so many packages. But I think the one that just it just makes me laugh. Even though we shouldn't laugh, I'm laughing. Crowdstrike. Yes. The company in which sells security solutions is in fact currently a distributor of a worm attack. I mean this is beautiful. This is this is I mean this is all life is art but unknown to thee. This is like the most just amazing situation of irony that has ever been created. Crowd strike blue screens of death or let me have all your tokens. Which which which one do you want? Huh? Also, there's a whole bunch of other this popular author Control got had through Tiny Color. Tiny Color apparently was the first version, which by him having those, he accidentally ended up getting had again further and further. As you can see right here, 4.11 and 4.12 were both bad versions of which when you look at Tiny Color 420, version 420 is the safe one. Okay. Hey, nice. I see what you did there. That was a good move. At the end of the day, I think the biggest takeaway here is stay away from auto upgrading. Take your time, understand what you're using, and maybe perhaps, I know this is going to be a crazy idea, maybe we don't need all of these dependencies. Maybe the singular function that you're using doesn't need to be an entire dependency with its own compounding effect of security vulnerabilities. And in the day and age of AI, left pad's pretty easy to generate. Oh, you need some sort of, you know, HSV to RGB converter. Pretty easy to generate, right? Like, this isn't even something that you need to first go off and get massive expertise. And the cost of creating one-off functions instead of downloading an entire repository worth of functions is now so low, you barely need anything. Maybe these repetitive attacks will get people thinking more and more about the dependencies they're taking. And hopefully, you will think about it, too. Because even again, even if you fix your patches, it doesn't mean the things you depend on fix your patches. Everybody needs to do it together. Okay? We're all in this together. Well, I'm not in this together. Okay? I don't like to program JavaScript. I use Elixir, by the way. So, not my problem, okay? Hey, that's that's actually your problem. We're not all in this together. You're in this together. You you npm enjoyers. Okay? Yuck. By the way, if you like this, press the like button. If you haven't subscribed, press it because we're getting close to a million. Okay, I'm like 10% away., This May Be the Worst One, ThePrimeTime, 01k5c7c6gfcmtqemhz4a6fp9wd.