Artwork

Content provided by Matt Lawrence and Mike Karan, Matt Lawrence, and Mike Karan. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Matt Lawrence and Mike Karan, Matt Lawrence, and Mike Karan or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://ppacc.player.fm/legal.
Player FM - Podcast App
Go offline with the Player FM app!

Web News: The Shai‑Hulud Worm Attack (NPM Hack)

37:06
 
Share
 

Manage episode 507523550 series 3328123
Content provided by Matt Lawrence and Mike Karan, Matt Lawrence, and Mike Karan. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Matt Lawrence and Mike Karan, Matt Lawrence, and Mike Karan or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://ppacc.player.fm/legal.

In this episode of Web News, Matt and Mike dive into two massive worm attacks that recently hit npm, targeting packages used in millions of projects. While the attackers aimed to steal crypto wallet keys, the actual damage was small—but the implications are enormous. We break down how these man-in-the-middle attacks worked, why shadow dependencies are such a big risk, and what tools like pnpm’s minimum release age can do to help. We also discuss whether AI might allow developers to skip quick one-time npm packages entirely, reducing dependency sprawl and potential vulnerabilities.

Show Notes: https://www.htmlallthethings.com/podcast/the-shai-hulud-worm-attack-npm-hack

  continue reading

423 episodes

Artwork
iconShare
 
Manage episode 507523550 series 3328123
Content provided by Matt Lawrence and Mike Karan, Matt Lawrence, and Mike Karan. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Matt Lawrence and Mike Karan, Matt Lawrence, and Mike Karan or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://ppacc.player.fm/legal.

In this episode of Web News, Matt and Mike dive into two massive worm attacks that recently hit npm, targeting packages used in millions of projects. While the attackers aimed to steal crypto wallet keys, the actual damage was small—but the implications are enormous. We break down how these man-in-the-middle attacks worked, why shadow dependencies are such a big risk, and what tools like pnpm’s minimum release age can do to help. We also discuss whether AI might allow developers to skip quick one-time npm packages entirely, reducing dependency sprawl and potential vulnerabilities.

Show Notes: https://www.htmlallthethings.com/podcast/the-shai-hulud-worm-attack-npm-hack

  continue reading

423 episodes

All episodes

×
 
Loading …

Welcome to Player FM!

Player FM is scanning the web for high-quality podcasts for you to enjoy right now. It's the best podcast app and works on Android, iPhone, and the web. Signup to sync subscriptions across devices.

 

Quick Reference Guide

Copyright 2025 | Privacy Policy | Terms of Service | | Copyright
Listen to this show while you explore
Play