Post

daniel r(ooooooh) in nyc 🇺🇸
@danielroe.dev

🚨 check your dependencies! in these 500+ packages, three third-party nuxt modules were affected: - @alexcolls/nuxt-ux - @alexcolls/nuxt-socket.io - @posthog/nuxt no dependencies of nuxt itself, or any of our first party modules, were affected.

Socket@socket.dev

We have updated this list to include more than 500 packages and 700+ affected versions, as well as a technical analysis of the attack. socket.dev/blog/shai-hu.... cc: @campuscodi.risky.biz @typescript.fm @bleepingcomputer.com @theregister.com

socket.devShai Hulud Strikes Again (v2) - SocketAnother wave of Shai-Hulud campaign has hit npm with more than 500 packages and 700+ versions affected.
Wes
@notwes.bsky.social

And as a maintainer, go read up on how you can prevent your package from being in the next list on a Socket blog post. > Follow OpenJS' guidance and understand the pros and cons to the different approaches to publishing to npm. openjsf.org/blog/publish...

openjsf.orgPublishing More Securely on npm: Guidance from the OpenJS Security Collaboration Space | OpenJS FoundationThe OpenJS Security Collaboration Space has been working closely with GitHub’s npm team to understand how new security features affect projects and maintainers, especially as threats and tools keep ev...
Wes
@notwes.bsky.social

Also, happy to have you on our Security Collab Space call to share that directly or in whatever other form you would prefer to give the feedback. Some of this stuff we just are not talking about publicly until things are settled down, but we can share them in other forums with trusted folks.