SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains

119•birdculture•1h ago

Comments

benzible•47m ago

Dup https://news.ycombinator.com/item?id=46032539

swsieber•41m ago

This article has quite a bit more information though.

thih9•40m ago

Not a dup, this is a different article about the same event, with different information too.

a4isms•35m ago

Please use the word "Dup" for a resubmission of the same link and "See also" for a different submission.

neogodless•25m ago

See also: https://news.ycombinator.com/item?id=46032539 Shai-Hulud Returns: Over 300 NPM Packages Infected (helixguard.ai)

~6 hours ago | 430 comments

nathan_compton•43m ago

I never, ever, do development outside of a podman container these days. Basically if I am going to run some code from somewhere and I haven't read it, it goes in a container.

I know its not foolproof, but I can't believe how often people run code they haven't read where it can make a huge mess, steal secrets, etc. I'll probably get owned someday, I'm sure, but this feels like a bare minimum.

rco8786•33m ago

How are you doing this in practice? These are npm packages. I don't see how could reasonably pull in Posthog's SDK in a container.

christophilus•32m ago

What do you mean? You can drop into bash in a container and run any arbitrary command, so `npm install foo` works just fine. Why would posthog's SDK be a special case?

LeifCarrotson•13m ago

I think the issue is more about what else has to go into or be connected to that container. Posthog isn't really useful if it's air-gapped. You're going to give it keys to access all kinds of juicy databases and analytics, and those NPM tokens, AWS/GCP/Azure credentials, and environment variables are exactly what it exfiltrates.

I don't run much on the root OS of my dev machine, basically everything is in a container or VM of some kind, but that's more so that I can reproduce my environment by copying a VMDK than in an effort to limit what the container can do to itself and data it has access to. Yeah, even with root access to a VM guest, an attacker they won't get my password manager, personal credit card, socials, etc. that I only use from the host OS... But they'll get everything that the container contains or has access to, which is often a lot of data!

Lutger•3m ago

You're severely limiting the blast radius. This malware works by exfiltrating secrets during installation, if I understood it correctly. If you would properly containerize your app and limit permissions to what is absolutely required, you could be compromised and still suffer little to no consequences.

Of course, this is not a real defense on its own, its just good practice to limit blast radius, much like not giving everybody admin rights.

myaccountonhn•24m ago

I ssh into a second local user and do development there instead with tmux.

n4r9•5m ago

I send mail to a demon which runs MsBuild and mails the output back to me.

netdevphoenix•24m ago

> if I am going to run some code from somewhere and I haven't read it, it goes in a container

How does this work? Every single npm package has tons of dependency tree nodes

Lutger•9m ago

Everything runs in the container and cannot escape it. Its like a sandbox.

You have to make sure you're not putting any secrets in the container environment.

moffkalast•4m ago

All right then, keep your secrets.

swsieber•9m ago

I didn't read this as separate containers.

echelon•1m ago

Another effective strategy I learned of recently that seems like it would have avoided this is to wait months before using new versions of packages.

Most attacks on popular packages last at most a few months before detection.

QuantumNomad_•40m ago

Typo in title. Current title of HN post says:

> SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

Should be Shai-Hulud, not SHA1-Hulud.

adzm•32m ago

That said, the secrets are uploaded to a repo named `Sha1-Hulud: The Second Coming`

zahlman•31m ago

Ah, I missed that detail.

zahlman•31m ago

I don't know why you were downvoted. The actual page does not say SHA1, the attack as far as I know is not related to the SHA1 algorithm, and the name of the worm isn't intended as that sort of pun.

pezezin•12m ago

The worm itself is posting the secrets in Github with the name Sha1-hulud: https://github.com/search?q=sha1-hulud&type=repositories

ChrisArchitect•22m ago

[dupe] Discussion: https://news.ycombinator.com/item?id=46032539

xnorswap•15m ago

Perhaps it's time to organize a curated "stable" stream for npm packages.

If I want more stability for my OS I can choose Debian-stable rather than Ubuntu-nightly.

But for npm, there doesn't seem to be the same choice available. Either I sign up to the fire-hose or I don't.

I can choose to only upgrade once a month, but there's a chance I'm still getting a package that dropped 5 minutes before.

smallerfish•13m ago

Because PostHog's "Talk to a human" chat instead gets a grumpy gatekeeping robot (which also doesn't know how to get you to a working urgent support link), and there's nothing prominently on their home page or github about this:

Hey PostHog! What version do we need to avoid?

raunakchowdhuri•8m ago

Have a slack channel with them, these are the versions they mentioned: posthog-node 4.18.1 posthog-js 1.297.3 posthog-react-native 4.11.1 posthog-docusaurus 2.0.6

timgl•8m ago

co-founder here. We mentioned it in the main thread about this: https://news.ycombinator.com/item?id=46032650 and on status.posthog.com

- posthog-node 4.18.1, 5.13.3 and 5.11.3

- posthog-js 1.297.3

- posthog-react-native 4.11.1

- posthog-docusaurus 2.0.6

If you make sure you're on the latest version you should be good.

smallerfish•5m ago

Thanks. Also - maybe change "talk to a human" to "talk to a grumpy robot" :)

jamietanna•12m ago

As it arguably would have reduced impact

(I'm one of the Renovate maintainers and have recently pushed for this to be more of a widely used feature)

SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

France threatens GrapheneOS with arrests / server seizure for refusing backdoors

NSA and IETF, part 3: Dodging the issues at hand

Inside Rust's std and parking_lot mutexes – who wins?

Chrome Jpegxl Issue Reopened

Corvus Robotics (YC S18): Hiring Head of Mfg/Ops, Next Door to YC Mountain View

Show HN: Cynthia – Reliably play MIDI music files – MIT / Portable / Windows

Serflings is a remake of The Settlers 1

Shai-Hulud Returns: Over 300 NPM Packages Infected

Fast Lua runtime written in Rust

We stopped roadmap work for a week and fixed bugs

Britain is one of the richest countries. So why do children live in poverty?

Slicing Is All You Need: Towards a Universal One-Sided Distributed MatMul

RuBee

Disney Lost Roger Rabbit

Japan's gamble to turn island of Hokkaido into global chip hub

Historically Accurate Airport Dioramas by AV Pro Designs

µcad: New open source programming language that can generate 2D sketches and 3D

Ask HN: Hearing aid wearers, what's hot?

Lambda Calculus – Animated Beta Reduction of Lambda Diagrams

The Rust Performance Book (2020)

I built an faster Notion in Rust

Show HN: Virtual SLURM HPC cluster in a Docker Compose

New magnetic component discovered in the Faraday effect

Building the largest known Kubernetes cluster, with 130k nodes

Show HN: Stun LLMs with thousands of invisible Unicode characters

Fran Sans – font inspired by San Francisco light rail displays

Ego, empathy, and humility at work

Set theory with types

The Cloudflare outage might be a good thing

SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

Comments

SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM

France threatens GrapheneOS with arrests / server seizure for refusing backdoors

NSA and IETF, part 3: Dodging the issues at hand

Inside Rust's std and parking_lot mutexes – who wins?

Chrome Jpegxl Issue Reopened

Corvus Robotics (YC S18): Hiring Head of Mfg/Ops, Next Door to YC Mountain View

Show HN: Cynthia – Reliably play MIDI music files – MIT / Portable / Windows

Serflings is a remake of The Settlers 1

Shai-Hulud Returns: Over 300 NPM Packages Infected

Fast Lua runtime written in Rust

We stopped roadmap work for a week and fixed bugs

Britain is one of the richest countries. So why do children live in poverty?

Slicing Is All You Need: Towards a Universal One-Sided Distributed MatMul

RuBee

Disney Lost Roger Rabbit

Japan's gamble to turn island of Hokkaido into global chip hub

Historically Accurate Airport Dioramas by AV Pro Designs

µcad: New open source programming language that can generate 2D sketches and 3D

Ask HN: Hearing aid wearers, what's hot?

Lambda Calculus – Animated Beta Reduction of Lambda Diagrams

The Rust Performance Book (2020)

I built an faster Notion in Rust

Show HN: Virtual SLURM HPC cluster in a Docker Compose

New magnetic component discovered in the Faraday effect

Building the largest known Kubernetes cluster, with 130k nodes

Show HN: Stun LLMs with thousands of invisible Unicode characters

Fran Sans – font inspired by San Francisco light rail displays

Ego, empathy, and humility at work

Set theory with types

The Cloudflare outage might be a good thing