this may be the worst one 🔗 **Source:** [this may be the worst one](https://www.youtube.com/watch?v=69F9IuBWb-E) > [!note]+ Document Notes > tags: [Assign relevant tags or keywords to the notee to facilitate organization and retrieval. Add a # before each tag. Tags cannot have special characters. Do not use the tag #articles] > - #supplychain > - #npm > - #security > Author: YouTube creator (channel not specified in transcript) > Source: YouTube video (transcript) > Reference: https://www.youtube.com/watch?v=69F9IuBWb-E > date created: {{date:YYYY-MM-DD}} {{time:HH:mm}} > > # 🪱 Title: “This May Be the Worst One” — Shai-Hulud npm Worm & Supply-Chain Lessons > <!-- deep-read:sections start --> ## 🧭 Table of Contents: - 🔗 [📝 Summary](#-summary) - 🔗 [📖 Main Content](#-main-content) - 🔗 [🗒️ Notes — Timestamped Subheadings (Clickable to YouTube)](#️-notes--timestamped-subheadings-clickable-to-youtube) - 🔗 [📖 References](#-references) - 🔗 [🗣️ Paraphrase](#-paraphrase) - 🔗 [📰 Newsletter](#-newsletter) - 🔗 [✅ Action Items](#-action-items) - 🔗 [🧪 Hypotheses](#-hypotheses) - 🔗 [📊 Methodology](#-methodology) - 🔗 [❓ Questions](#-questions) - 🔗 [🔮 Future Research](#-future-research) - 🔗 [💡 Implications](#-implications) - 🔗 [🧠 Learning Styles Assessment](#-learning-styles-assessment) - 🔗 [📊 Accessibility Assessment](#-accessibility-assessment) - 🔗 [🌍 DEIB Assessment](#-deib-assessment) - 🔗 [✅ Logical Validity & Tone](#-logical-validity--tone) - 🔗 [🛡️ DARVO Analysis](#-darvo-analysis) - 🔗 [🔍 SEO Evaluation](#-seo-evaluation) - 🔗 [🎯 Conclusion](#-conclusion) ### 📚 References: Include a list of sources consulted and cited in the article. - 🔗 Primary: Video transcript — https://www.youtube.com/watch?v=69F9IuBWb-E - 🔗 Mentioned concepts/tools: TruffleHog, GitHub Actions, post-install scripts, semantic-versioning (no external sources cited in the video) --- ## 📝 Summary: - 🪱 A worm-style npm attack (“Shai-Hulud”) propagated repo-to-repo by stealing tokens and mutating CI to push malicious patch versions. - 🔒 The presenter stresses version pinning, smaller dependency trees, and CI/token hardening as practical defenses. - 🧪 The attack abused post-install scripts and secret-scanning tooling to exfiltrate credentials, then auto-republished. - 🧱 Even careful teams can be exposed through floating transitive dependencies. --- ## 📖 Main Content: - 🧠 **Threat model shift:** Not just “user installs a bad package.” The worm targets maintainers and CI to **manufacture** more bad packages. - 🧰 **Technique stack:** Post-install runner → secrets scanner abuse → token capture → GH Actions edits → publish wormed patch versions. - 🧱 **Amplifiers:** Auto-upgrade ranges (`^`/`~`), dormant packages revived with tiny version bumps, and long-lived CI tokens. - 🧯 **Defensive stance:** Pin versions; whitelist or block post-install; rotate to short-lived tokens; restrict CI permissions; prune trivial dependencies. --- ## 🗒️ Notes — Timestamped Subheadings (Clickable to YouTube) ### 🔥 [0:00–0:10 • Third npm incident in a week (hook)](https://www.youtube.com/watch?v=69F9IuBWb-E&t=0s) - 🧷 Sets urgency: “How is this still happening?” Repetition primes risk awareness. - 🧭 Frames topic: supply-chain attacks as a recurring systemic failure. ### 🪙 [0:16–0:33 • “Shai-Hulud” name & Dune riff](https://www.youtube.com/watch?v=69F9IuBWb-E&t=16s) - 🧩 “Tokens must flow” gag connects theme: tokens as the attack’s currency. - 🎭 Humor lowers the shield while keeping focus on credential theft. ### 🧬 [0:31–1:18 • Why this one is worse: lateral spread](https://www.youtube.com/watch?v=69F9IuBWb-E&t=31s) - 🦠 Not only exfiltration; it **self-propagates** repo→repo via CI mutation. - 🧰 Blends multiple attack modes: phishing + worming + supply-chain tampering. ### 🎣 [1:21–1:40 • Likely phishing origin](https://www.youtube.com/watch?v=69F9IuBWb-E&t=81s) - 🧵 Initial foothold from a smaller repository compromise. - 💤 Dormant package revived; audience warned about “long-quiet” packages. ### 🧪 [1:40–1:58 • Malicious patch bumps (0.0.5 / 0.0.6)](https://www.youtube.com/watch?v=69F9IuBWb-E&t=100s) - 🧨 Tiny semver changes smuggle the payload. - 🧭 Lesson: treat patch bumps as untrusted until reviewed. ### 🔒 [2:01–2:25 • “Do not auto-upgrade patch versions”](https://www.youtube.com/watch?v=69F9IuBWb-E&t=121s) - 🧱 Floating ranges widen your blast radius. - 🔁 Even if you pin, upstreams can still float; transitive risk remains. ### ⚙️ [2:47–3:06 • Dependency automation critique](https://www.youtube.com/watch?v=69F9IuBWb-E&t=167s) - 🛑 Over-automation without review ≈ “walking into hell.” - 🧮 Policy hint: favor manual promotion + release note checks. ### 🧰 [3:07–3:19 • Post-install again, but different payload](https://www.youtube.com/watch?v=69F9IuBWb-E&t=187s) - 🧪 Compares to prior NX incident; similar vector, new behavior. ### 🕵️ [3:29–3:41 • TruffleHog abuse](https://www.youtube.com/watch?v=69F9IuBWb-E&t=209s) - 🐗 Legit secret scanner repurposed for credential harvesting. - 🧷 Reminder: dual-use tools require context-aware controls. ### 🧵 [4:01–4:21 • CI pivot: mutate GitHub, republish](https://www.youtube.com/watch?v=69F9IuBWb-E&t=241s) - 🧪 Edits GH Actions, injects post-install, publishes infected patches. - 🧱 Turns victims into amplifiers across the dependency graph. ### 🖥️ [4:36–4:50 • Workstations and CI both at risk](https://www.youtube.com/watch?v=69F9IuBWb-E&t=276s) - 🔑 Any environment holding tokens becomes an entry point. - 🔒 Emphasizes token scope, rotation, and short lifetimes. ### 📈 [4:52–5:12 • From ~40 to ~180 packages (fast growth)](https://www.youtube.com/watch?v=69F9IuBWb-E&t=292s) - 🧮 Uses hyperbole (“24B”) as a joke; still signals exponential spread. - 🧭 Practical read: watch for fast-moving advisories and revoke early. ### 🏢 [5:12–5:25 • Ironic vendor infections](https://www.youtube.com/watch?v=69F9IuBWb-E&t=312s) - 🎭 Irony aside, message is clear: **no one** is exempt from process debt. ### 🎨 [5:47–6:12 • @ctrl/tinycolor versions flagged](https://www.youtube.com/watch?v=69F9IuBWb-E&t=347s) - 🧪 “4.11 / 4.12 bad; 4.20 safe” per presenter’s riff. - 🧭 Action: verify advisories; don’t trust hearsay—check your lockfile. ### 🪓 [6:15–6:37 • Fewer dependencies thesis](https://www.youtube.com/watch?v=69F9IuBWb-E&t=375s) - 🧰 For single-function needs, write a vetted snippet. - 🧱 Shrink attack surface; reduce transitive surprises. ### 🤖 [6:34–7:02 • AI can generate simple utilities](https://www.youtube.com/watch?v=69F9IuBWb-E&t=394s) - 🧪 Use with review and tests; don’t trade one risk for another. - 🧭 Codify a checklist before adopting AI-generated code. ### 🤝 [7:00–7:16 • Collective security responsibility](https://www.youtube.com/watch?v=69F9IuBWb-E&t=420s) - 🧱 You pinning isn’t enough if upstreams float. - 🧭 Ecosystem norms matter: SBOMs, attestations, policy. ### 🎬 [7:16–end • Tone & sign-off](https://www.youtube.com/watch?v=69F9IuBWb-E&t=436s) - 🎭 Satirical closer (“I use Elixir”) to keep energy high. - 📣 Call to engage; implicit nudge toward shared security culture. --- ## 📖 References: - 🔗 Video transcript: https://www.youtube.com/watch?v=69F9IuBWb-E - 📝 In-video mentions (no external cites provided): TruffleHog, GitHub Actions, @ctrl/tinycolor, NX incident, post-install scripts --- ## 🗣️ Paraphrase: - 🧩 **Version discipline, reworded:** Treat patch bumps as hostile until proven safe. Float nothing on build paths. Promote with human review and clear provenance. - 🧯 **Dependency minimalism, reworded:** For small utilities, a well-tested local function beats a heavy package. Fewer deps mean fewer places for worms to hide. --- ## 📰 Newsletter: - 🪱 **npm’s Shai-Hulud worm:** A repo-to-repo spread used post-install and CI token abuse to publish malicious patch versions at speed. - 🔧 **Fix it fast:** Pin versions, rotate tokens, lock down GH Actions, and prune trivial deps. Add SBOM + provenance to your release checklist. - 🧭 **For WordPress builders:** If Node sits in your build chain, treat it like prod—deny unvetted post-install, require reviews, and track transitive risk. - 🎥 Watch: https://www.youtube.com/watch?v=69F9IuBWb-E --- ## ✅ Action Items: - 🔒 **Pinning policy:** Enforce exact versions for build-time deps; block `^`/`~` in CI for production paths. - 🗝️ **Token hygiene:** Rotate all PATs; move to short-lived OIDC; least privilege on publish scopes. - 🧱 **CI hardening:** Protect default branches; signed commits/tags; review gates for GH Actions changes; block post-install unless whitelisted. - 📦 **Dep diet:** Inventory and replace trivial libraries with audited internal snippets; measure transitive shrinkage. - 🧑‍🏫 **Education:** Add a contributor module on semver risk, CI trust boundaries, and post-install review to Training Team materials. - 🏛️ **OSPO move:** Propose a GoDaddy Open-Source Supply-Chain Standard (SBOM, SLSA target, incident playbooks). Share a public version via The WPCC for ecosystem lift. --- ## 🧪 Hypotheses: - 🧪 H1: Exact-pinning build deps reduces successful supply-chain incidents ≥50% in six months. - 🧪 H2: Replacing 10% of trivial deps with internal utilities reduces transitive attack surface ≥30%. - 🧪 H3: Short-lived OIDC tokens cut credential reuse windows to <24h per repo. - 🧪 H4: Mandatory reviews on GH Actions changes prevent ≥80% of worm re-propagation events. --- ## 📊 Methodology: - 🧭 **Design:** Phased rollout across teams; control vs. treatment (pins + OIDC + CI gates). - 📈 **Metrics:** Incident count, time-to-detect, mean time-to-recover, SBOM coverage, % deps pruned. - 🧷 **Data:** CI logs, git audit, dependabot PRs, secret-scanner alerts, postmortems. - 🔍 **Analysis:** Interrupted time-series; diff-in-diff across cohorts; risk scoring for transitive trees. --- ## ❓ Questions: - ❓ Can we auto-block post-install unless signed and whitelisted? - ❓ Which top transitive packages drive most exposure by install base? - ❓ How do we standardize provenance checks across WP plugin/theme pipelines? - ❓ Where should we set the bar for “assist vs. auto-author” in CI? --- ## 🔮 Future Research: - 🔮 Detecting lateral CI mutations in near-real time (Actions diffing, maintainer anomaly detection). - 🔮 Policy experiments: deny `^/~` on production builds; allow only exacts. - 🔮 Maintainer-support pilots: stipends and security coaching to reduce compromise risk. - 🔮 Attestation UX tailored for WordPress release flows. --- ## 💡 Implications: - 💡 Pinning + provenance becomes table stakes for JS toolchains that touch WordPress. - 💡 Funding maintainers is a **security** investment, not charity. - 💡 Shared norms (SBOMs, attestations, review gates) build ecosystem-level resilience. --- ## 🧠 Learning Styles Assessment: - 🖼️ **Visual:** Video only; no diagrams. Add dependency graphs and CI flowcharts. - 🎧 **Aural:** Strong via video; offer audio-only cut and 90-second summary. - 📝 **Verbal:** Conversational and analogy-rich; add a glossary for newcomers. - ✋ **Kinesthetic:** Provide a lab to catch a safe, simulated post-install in a sandbox. - 🧮 **Logical:** Supply a decision tree for “allow/deny post-install,” “float vs. pin.” - 👥 **Social:** Host maintainer office hours; run tabletop incident drills. - 🧘 **Solitary:** Include a checklist and journaling prompts (“What tokens exist in our CI?”). - 🌱 **Naturalistic:** Use ecosystem analogies (invasive species ≈ transitive deps). - 📏 **Readability:** Estimated Flesch-Kincaid Grade 9–10; fast pace; define jargon inline. --- ## 📊 Accessibility Assessment: - 🔊 **Screen readers:** Add semantic headings, accurate captions, and descriptive transcripts. - ⌨️ **Keyboard:** Ensure skip links and clear focus states in any written recap page. - 🎨 **Contrast:** High-contrast palettes; avoid text baked into images; scalable fonts. - 🔍 **Text resizing:** Verify reflow at 200% zoom; responsive tables/diagrams. - 🖼️ **Alt text:** Provide alt text for graphs (dependency maps, timelines). --- ## 🌍 DEIB Assessment: - 🗣️ **Inclusive language:** Avoid shaming newcomers (“npm enjoyers yuck” can alienate); define acronyms. - 🌐 **Global access:** Provide low-bandwidth text recap; translate key guidance. - 🧩 **Neurodiversity:** Break content into clear chunks; add summaries and checklists. - 👥 **Representation:** Include examples from diverse maintainer communities and org sizes. - 🛟 **Psychological safety:** Promote blameless postmortems; focus on systems over individuals. --- ## ✅ Logical Validity & Tone: - ✅ **Causal chain:** Floating ranges → unreviewed code → compromise cascade; coherent and plausible. - ✅ **Inductive support:** Multiple recent incidents justify stronger pinning and CI gates. - ✅ **Balanced stance:** Automation needs guardrails, not total rejection. - ⚠️ **Hasty generalization:** Exaggerated “24B packages” is humor; avoid as evidence. - ⚠️ **Appeal to ridicule:** Vendor irony entertains; separate it from technical critique. - 🎙️ **Tone:** High-energy, sarcastic, memorable; effective for engagement, light on citations. --- ## 🛡️ DARVO Analysis: - ⛔ **Deny:** No denial; acknowledges repeated ecosystem failures. - ⚔️ **Attack:** Light mockery of affected vendors; not central to the argument. - 🔄 **Reverse victim/offender:** Not present; developers cast as victims of systemic risk. - 🧭 **Net:** No DARVO structure; rhetoric pushes for practical defenses. --- ## 🔍 SEO Evaluation: - 🔑 **Keywords:** npm worm, Shai-Hulud, post-install, CI tokens, GitHub Actions, supply-chain security. - 🏷️ **Title tag:** “npm Shai-Hulud Worm: Post-Install + CI Token Abuse Explained.” - 📝 **Meta:** “How a worm spread via CI and patch bumps—and how to pin, prune, and protect.” (≤160 chars) - 🧱 **Headers:** Use H2/H3 for “How it spreads,” “Mitigations,” “Checklist.” - 📏 **Length:** Aim 1,200–1,800 words for a written recap. - 🔗 **Links:** Add advisories/CVEs and tool docs; cross-link internal IR guides. - 🌐 **URL:** `/security/npm-shai-hulud-worm-mitigations` - 🖼️ **Images:** Optimized SVG diagrams with alt text. - 📱 **Mobile:** Test LCP/CLS; defer heavy embeds. - 🧩 **Schema:** `VideoObject` + `Article`; optional `FAQPage`. - 📣 **Sharing:** Open Graph/Twitter Cards; clear CTA to “Copy mitigation checklist.” --- ## 🎯 Conclusion: - 🪱 Shai-Hulud weaponizes **your** CI and transitive tree. - 🔒 Defense wins: exact-pin versions, short-lived tokens, hardened Actions, fewer trivial deps, and shared provenance norms. - 🤝 WordPress and npm communities improve together by turning these practices into **policy**, not panic. <!-- deep-read:sections end --> ## 📺 Video  --- # 📄 Full Transcript *Auto-generated from YouTube captions · timestamps roughly every 30 seconds · [watch on YouTube](https://www.youtube.com/watch?v=69F9IuBWb-E)* **[00:00]** I don't understand how this keeps happening. How are we here? Three times in a single week. Yes, another supply chain attack happened again on npm. And yes, a lot and a lot of repositories were affected. Now, this one code named Shy Halude. Obviously, the tokens must flow. Okay, the tokens. Just give me the tokens. There are so many twists to this one. This one is an absolute masterclass in just destroying an ecosystem. Now **[00:31]** what makes Shy Hulu different here is that instead of just simply being something in which the end user ends up downloading an npm package and then what the post install script goes and takes all your credentials and like I got your tokens. Yes. Yes. Instead, it doesn't just do that. It spreads itself from repository to repository to repository and just keeps on growing. So, this isn't just simply a fishing attack. It's like all the attacks in one. Also, very impressive that it's the Singularity NX **[01:01]** hack that happened just last week. This appears to be by the same crew. Okay, they're on a they're on a hacking spree. Okay, this is a this is a double hack. I mean, they might even get to a triple hack potentially. A a hacktacular is on the horizon. All right, let's just jump right into it. So, how did this hack happen again? Now, first off, it likely occurred due to a fishing scam. That's what everything is saying. I asked Grock to find some sources. It just appears that fishing was the root cause. Some **[01:32]** small repository got had. The unknown repository is likely this uh RX NT authentication, which has been deprecated, hasn't seen any publications for a long time. Then out of nowhere 4 days ago got a new version which was going to be 005 which it looks like it's been removed already and 006 which both contained this attack. Now the attack took advantage of the exact same thing again a little patch version update. Now I don't know why this keeps happening. I swear I keep saying this. Don't **[02:05]** autoupgrade patch versions. It's like a massive security vulnerability. This is like the easiest way to be had ever yet it just keeps happening. Why? Why do you keep doing it? Say no. Lock your versions. Now obviously this is really really difficult because you may lock your versions and you may be the good you know the good citizen in this situation. But remember package managers are in fact evil and people who don't lock their versions can still get you **[02:35]** because you rely on them. They rely on other things. those other things get, you know, supply chain attacked. Boom. It trickles all the way down to you despite the fact that you did all the right steps. And Ginger Bill maybe is right. Maybe Ginger Bill is correct. Automation of package dependencies is walking into hell and we should all avoid it as much as we possibly can. I don't know. Maybe he is right. Mr. Quantum mechanic scientist who moonlights as language creator. **[03:06]** Anywh who, so after the patch version has been installed, a post install script again gets installed and this time instead of using like say the AI to go through your system and get all the credentials, which is what happened last time with the NX attack, which by the way was just a couple days ago. Okay, no sleep for the weary here. We just got to go from one attack to the next attack. This one instead uses something called Truffle Hog, which by the way, insane name. Old girl, I'm going to slip my truffle hog on that computer and I'm going to get so many tokens you don't **[03:37]** even know. A truffle hog is like a secret scanning tool. You're supposed to use it on your repository or use it in CI to make sure you're not accidentally leaking tokens. So like its idea is actually good. Unless if someone uses it for not good, then it's bad. Then it's really bad. So anyways, after getting your tokens, so this is where the things take a turn. So unlike the previous one and all unlike most of these attacks which take your tokens and then throws them all up onto a repository and it's like talk about all your tokens. This time instead just immediately goes to **[04:09]** work on your GitHub. Oh, we're going to update some CI. We're going to put in some new post installation. We're going to publish to npm. It does all the things to attempt to go publish patch versions with its new installation process that has the post install that does and does it again. So that way if one unknown repository gets had during CI of the next one, it goes d and just get just it's just flying through the system. That means you're vulnerable on your desktop if you have tokens that can be taken advantage of. That means your **[04:41]** CI is vulnerable if your CI has the tokens that can be taken advantage of. Now hide like literally hide your kids, hide your wives, hide your husband because they're stealing everybody's tokens out here. So, as this thing has progressed, it started off with 40 npm packages that have been compromised. Now, it's up to 180. This is only just a few hours later. My guess is that by the end of the week, it'll be like 24 billion just by the growth rate here. I want to take a look at who got affected because as you can see, there's just so many packages. But I think the one that **[05:12]** just it just makes me laugh. Even though we shouldn't laugh, I'm laughing. Crowdstrike. Yes. The company in which sells security solutions is in fact currently a distributor of a worm attack. I mean this is beautiful. This is this is I mean this is all life is art but unknown to thee. This is like the most just amazing situation of irony that has ever been created. Crowd strike blue screens of death or let me have all **[05:42]** your tokens. Which which which one do you want? Huh? Also, there's a whole bunch of other this popular author Control got had through Tiny Color. Tiny Color apparently was the first version, which by him having those, he accidentally ended up getting had again further and further. As you can see right here, 4.11 and 4.12 were both bad versions of which when you look at Tiny Color 420, version 420 is the safe one. Okay. Hey, nice. I see what you did there. That was a good move. At the end of the day, I think the biggest takeaway here is stay away from auto upgrading. **[06:15]** Take your time, understand what you're using, and maybe perhaps, I know this is going to be a crazy idea, maybe we don't need all of these dependencies. Maybe the singular function that you're using doesn't need to be an entire dependency with its own compounding effect of security vulnerabilities. And in the day and age of AI, left pad's pretty easy to generate. Oh, you need some sort of, you know, HSV to RGB converter. Pretty easy to generate, right? Like, this isn't even something that you need to first go **[06:46]** off and get massive expertise. And the cost of creating one-off functions instead of downloading an entire repository worth of functions is now so low, you barely need anything. Maybe these repetitive attacks will get people thinking more and more about the dependencies they're taking. And hopefully, you will think about it, too. Because even again, even if you fix your patches, it doesn't mean the things you depend on fix your patches. Everybody needs to do it together. Okay? We're all in this together. Well, I'm not in this together. Okay? I don't like to program **[07:16]** JavaScript. I use Elixir, by the way. So, not my problem, okay? Hey, that's that's actually your problem. We're not all in this together. You're in this together. You you npm enjoyers. Okay? Yuck. By the way, if you like this, press the like button. If you haven't subscribed, press it because we're getting close to a million. Okay, I'm like 10% away.