Publication croisée depuis https://programming.dev/post/41331208
"Upon execution, the malware downloads and runs TruffleHog to scan the local machine, stealing sensitive information such as NPM Tokens, AWS/GCP/Azure credentials, and environment variables.
The malicious code exfiltrates the stolen information by creating a GitHub Action runner named SHA1HULUD, and a GitHub repository description Sha1-Hulud: The Second Coming… This suggests it may be the same attacker behind the “Shai-Hulud” attack observed in September 2025.
And now, over 27,000 GitHub repositories were infected."
NPM should be destroyed, at this point… so many problems come from that place.
The Problem is not npm. The same can happen for maven, crates, gomods, and other. The problem is that all of these provide and generated a dependency hell where you implement one dependency for one thing which contains 10 subdependency where each of these dependency contain dependencies again. That the dependency hell which is causing such problems. The problem is not npm, its the mindset of developers.
Yes.
Nah. Dependencies are fine. The method of bringing those in and validating them is where the supply-chain risk accumulates. We knew better when we still had mentors.