npm

JavaScript dependency trees turn a tiny convenience library into a path for a compromise. The practical task is not merely to remove one package, but to find where it entered the build.

HN treated the episode as another reason that package provenance and update discipline belong to ordinary engineering work.

Running npm install would have been enough. The package's prepare script auto-runs a file that, buried under walls of commented-out tests, fetches and executes whatever a remote server sends back.

He never cloned it locally. He spun up a throwaway VPS, pointed a read-only AI agent at the tree, and it flagged app/test/index.js almost immediately. The thread's verdict on who's behind it was fast and grim: DPRK.

The official repos were never touched; this lived entirely in the AUR, Arch's explicitly unvetted, build-it-yourself user repository. An infosec consultant posted the exact pacman incantation to find foreign packages on your own box.

The fastest containment wasn't a patch. It was volunteers racing to adopt rarely-updated orphan packages so attackers couldn't, while others argued the AUR needs minimum package ages and adoption limits, like npm.