frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

France's homegrown open source online office suite

https://github.com/suitenumerique
45•nar001•1h ago•22 comments

Start all of your commands with a comma (2009)

https://rhodesmill.org/brandon/2009/commands-with-comma/
319•theblazehen•2d ago•106 comments

Hoot: Scheme on WebAssembly

https://www.spritely.institute/hoot/
43•AlexeyBrin•2h ago•8 comments

Reinforcement Learning from Human Feedback

https://arxiv.org/abs/2504.12501
23•onurkanbkrc•1h ago•1 comments

OpenCiv3: Open-source, cross-platform reimagining of Civilization III

https://openciv3.org/
724•klaussilveira•16h ago•224 comments

Software Engineering Is Back

https://blog.alaindichiappari.dev/p/software-engineering-is-back
48•alainrk•1h ago•44 comments

The Waymo World Model

https://waymo.com/blog/2026/02/the-waymo-world-model-a-new-frontier-for-autonomous-driving-simula...
986•xnx•22h ago•562 comments

Vocal Guide – belt sing without killing yourself

https://jesperordrup.github.io/vocal-guide/
109•jesperordrup•7h ago•41 comments

Ga68, a GNU Algol 68 Compiler

https://fosdem.org/2026/schedule/event/PEXRTN-ga68-intro/
22•matt_d•3d ago•4 comments

Unseen Footage of Atari Battlezone Arcade Cabinet Production

https://arcadeblogger.com/2026/02/02/unseen-footage-of-atari-battlezone-cabinet-production/
79•videotopia•4d ago•12 comments

Making geo joins faster with H3 indexes

https://floedb.ai/blog/how-we-made-geo-joins-400-faster-with-h3-indexes
143•matheusalmeida•2d ago•37 comments

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

https://github.com/valdanylchuk/breezydemo
245•isitcontent•17h ago•27 comments

Monty: A minimal, secure Python interpreter written in Rust for use by AI

https://github.com/pydantic/monty
252•dmpetrov•17h ago•129 comments

Cross-Region MSK Replication: K2K vs. MirrorMaker2

https://medium.com/lensesio/cross-region-msk-replication-a-comprehensive-performance-comparison-o...
5•andmarios•4d ago•1 comments

Show HN: I spent 4 years building a UI design tool with only the features I use

https://vecti.com
347•vecti•19h ago•153 comments

Hackers (1995) Animated Experience

https://hackers-1995.vercel.app/
514•todsacerdoti•1d ago•249 comments

Sheldon Brown's Bicycle Technical Info

https://www.sheldonbrown.com/
397•ostacke•22h ago•102 comments

What Is Ruliology?

https://writings.stephenwolfram.com/2026/01/what-is-ruliology/
49•helloplanets•4d ago•50 comments

Show HN: If you lose your memory, how to regain access to your computer?

https://eljojo.github.io/rememory/
312•eljojo•19h ago•193 comments

Show HN: Kappal – CLI to Run Docker Compose YML on Kubernetes for Local Dev

https://github.com/sandys/kappal
4•sandGorgon•2d ago•1 comments

Microsoft open-sources LiteBox, a security-focused library OS

https://github.com/microsoft/litebox
363•aktau•23h ago•189 comments

An Update on Heroku

https://www.heroku.com/blog/an-update-on-heroku/
443•lstoll•23h ago•291 comments

PC Floppy Copy Protection: Vault Prolok

https://martypc.blogspot.com/2024/09/pc-floppy-copy-protection-vault-prolok.html
78•kmm•5d ago•11 comments

Dark Alley Mathematics

https://blog.szczepan.org/blog/three-points/
98•quibono•4d ago•24 comments

Was Benoit Mandelbrot a hedgehog or a fox?

https://arxiv.org/abs/2602.01122
26•bikenaga•3d ago•14 comments

How to effectively write quality code with AI

https://heidenstedt.org/posts/2026/how-to-effectively-write-quality-code-with-ai/
282•i5heu•19h ago•232 comments

Female Asian Elephant Calf Born at the Smithsonian National Zoo

https://www.si.edu/newsdesk/releases/female-asian-elephant-calf-born-smithsonians-national-zoo-an...
48•gmays•12h ago•19 comments

I now assume that all ads on Apple news are scams

https://kirkville.com/i-now-assume-that-all-ads-on-apple-news-are-scams/
1093•cdrnsf•1d ago•474 comments

Understanding Neural Network, Visually

https://visualrambling.space/neural-network/
313•surprisetalk•3d ago•45 comments

I spent 5 years in DevOps – Solutions engineering gave me what I was missing

https://infisical.com/blog/devops-to-solutions-engineering
160•vmatsiiako•21h ago•73 comments
Open in hackernews

Shai Hulud launches second supply-chain attack

https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
352•birdculture•2mo ago

Comments

benzible•2mo ago
Dup https://news.ycombinator.com/item?id=46032539 [edit: not a dup!]
swsieber•2mo ago
This article has quite a bit more information though.
dang•2mo ago
Thanks—I've added this link to the toptext at https://news.ycombinator.com/item?id=46032539.
thih9•2mo ago
Not a dup, this is a different article about the same event, with different information too.
a4isms•2mo ago
Please use the word "Dup" for a resubmission of the same link and "See also" for a different submission.
neogodless•2mo ago
See also: https://news.ycombinator.com/item?id=46032539 Shai-Hulud Returns: Over 300 NPM Packages Infected (helixguard.ai)

~6 hours ago | 430 comments

dang•2mo ago
Ok, we've merged the (relevant) comments thither. Thanks!

Edit: Here's a bit of explanation for those curious. Even though the links are different, the test we use for whether to merge threads is whether they are substantially the same story vs. whether the two links will lead to substantially different discussion. In this case it's clear that it's the same discussion, so I merged them.

Since the second link has additional information, I've added it to the toptext of the original post. That way people can look at both.

QuantumNomad_•2mo ago
Typo in title. Current title of HN post says:

> SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

Should be Shai-Hulud, not SHA1-Hulud.

adzm•2mo ago
That said, the secrets are uploaded to a repo named `Sha1-Hulud: The Second Coming`
zahlman•2mo ago
Ah, I missed that detail.
zahlman•2mo ago
I don't know why you were downvoted. The actual page does not say SHA1, the attack as far as I know is not related to the SHA1 algorithm, and the name of the worm isn't intended as that sort of pun.
pezezin•2mo ago
The worm itself is posting the secrets in Github with the name Sha1-hulud: https://github.com/search?q=sha1-hulud&type=repositories
cyberpunk•2mo ago
Yikes. AWS secrets galore in the couple I decoded (double base64)...

I'm surprised github is leaving these up.

galangalalgol•2mo ago
At this point it likely helps the defenders more than those that would use them doesn't it?
meowface•2mo ago
I am guessing they don't intend to and will be removing them with urgency.
AlexandrB•2mo ago
Also "coming" only has one "m". Or is this some kind of pun?
ChrisArchitect•2mo ago
[dupe] Discussion: https://news.ycombinator.com/item?id=46032539
welder•2mo ago
Python script to check if any of your repos have the listed compromised packages in pnpm or npm lock files:

https://chatgpt.com/s/t_6924b232a8f88191a146a510c6631143

artisin•2mo ago
Worth mentioning that Bubblewrap[1] (bwrap) can remove most npm/node attack vectors or, at the very least, limit the damage from running arbitrary code during install/execution. Far from a silver bullet, and you'll want to combine it with a simple wrapper script to avoid dinking around with all its arguments, but it beats dealing with rootless Podman containers.

[1] https://github.com/containers/bubblewrap

port11•2mo ago
This looks really interesting, but it sounds like it's as complicated to setup as rootless Podman — which is to say not _that_ complicated. Anyone using this with Node or Deno successfully?
bunnybender•2mo ago
From my bookmarks (2023): https://news.ycombinator.com/item?id=36686461
port11•2mo ago
Lovely. Thank you very much!
splix•2mo ago
We made a script to avoid such situations. It checks the dependencies, just by parsing the package.json (or the lock file), checking the relevant time on npm registry, and returns error if it finds a too fresh package added.

We run it on CI for each commit/PR, and if a developer tries to commit a change that updates a JS dependency to a too recent it prevents the build from running, and so on. Basically we expect that a Supply Chain attacks on NPM would be noticed in a couple of week, and we enforce this time window to our code.

See https://github.com/emeraldpay/paranoid.js