A Shai-Hulud attack turns npm transitive dependencies into the incident (aikido.dev)
JavaScript dependency trees turn a tiny convenience library into a path for a compromise. The practical task is not merely to remove one package, but to find where it entered the build.
HN treated the episode as another reason that package provenance and update discipline belong to ordinary engineering work.
Sign in to save