Post

The Second Wave of Shai Hulud Supply Chain Attak is a dress up party for selling useless SAST software.

Solution… COMPANIES NEED TO STOP TAKING ADVANTAGE OF THE SITUATION AND START SUPPORT OPEN SOURCE SOFTWARE WITH RESOURCES OR RISK GETTING SHAI HULUDED UP THEIR ***

28/11/25, 8:47 am1 repost3 likes

naugtur

@naugtur.pl

28 Nov 2025

The only reason why this particular attack is so powerful is ubiquitous default to running install scripts. All we need to do is disable them everywhere and at all times. Then give people tools to control what they run that are not naive and don't run by default. www.npmjs.com/package/@lav...

It's free forever, simple to roll out and immune to getting confused with bundled dependencies whose names happen to match something that's allowed. And if you've read this far, please help me test and improve github.com/lavamoat/kip...

github.comGitHub - LavaMoat/kipuka: Easy, composable and transparent way to run things in a docker container.Easy, composable and transparent way to run things in a docker container. - LavaMoat/kipuka