Scott and Wes break down the “Mini Shai-Hulud” supply chain attack that compromised TanStack and other popular npm packages through a clever GitHub Actions cache poisoning exploit; a self-propagating worm that stole credentials and persisted through Claude Code hooks and VS Code tasks. They also cover how developers can protect themselves using pnpm’s security defaults, dev containers, and other practical defenses.
<h3 class="code-line">
<a></a>Show Notes</h3>
<ul>
<li class="has-line-data">
<a href="#t=00:00">00:00</a> Welcome to Syntax!</li>
<li class="has-line-data">
<a href="#t=00:25">00:25</a> Understanding the <a href="https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack">Shai-Hulud Worm</a>
<ul>
<li class="has-line-data"><a href="https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem">Post Mortem of Shai Hulud Attack</a></li>
</ul>
</li>
<li class="has-line-data">
<a href="#t=02:47">02:47</a> Mechanics of the Attack: GitHub Actions and Cache
<ul>
<li class="has-line-data"><a href="https://x.com/sebastienlorber/status/2054108973352038618?s=20">How the attack happened</a></li>
<li class="has-line-data"><a href="https://x.com/hetmehtaa/status/2054158511073116266">Who Was Involved in the Attack</a></li>
<li class="has-line-data"><a href="https://github.com/TanStack/router/issues/7383#issuecomment-4424629798">Several npm latest releases are compromised</a></li>
<li class="has-line-data"><a href="https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack">Socket.dev</a></li>
<li class="has-line-data"><a href="https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem">Step Security</a></li>
</ul>
</li>
<li class="has-line-data">
<a href="#t=05:44">05:44</a> Brought to you by <a href="https://sentry.io/syntax">Sentry.io</a>
</li>
<li class="has-line-data">
<a href="#t=06:09">06:09</a> Propagation and Impact of the Worm</li>
<li class="has-line-data">
<a href="#t=09:30">09:30</a> Preventative Measures for Developers
<ul>
<li class="has-line-data"><a href="https://x.com/dabit3/status/2053956743621648789">Dead Man’s Switch</a></li>
</ul>
</li>
<li class="has-line-data">
<a href="#t=12:33">12:33</a> The Role of Package Managers in Security
<ul>
<li class="has-line-data"><a href="https://pnpm.io/settings#blockexoticsubdeps">Block Exotic Subdeps</a></li>
</ul>
</li>
<li class="has-line-data">
<a href="#t=18:39">18:39</a> Using Dev Containers
<ul>
<li class="has-line-data"><a href="https://www.youtube.com/watch?v=kPMA9cnpScU">Why You Should Use Dev Containers</a></li>
<li class="has-line-data"><a href="https://github.com/stolinski/s-stack/tree/main/skills/security-review">Scott Tolinski’s Security Review</a></li>
</ul>
</li>
<li class="has-line-data">
<a href="#t=20:57">20:57</a> Conclusion and Final Thoughts
<ul>
<li class="has-line-data"><a href="https://github.com/getsentry/skills">Sentry has Skills!</a></li>
</ul>
</li>
</ul>
<h3 class="code-line">
<a></a>Hit us up on Socials!</h3>
Syntax: <a href="https://twitter.com/syntaxfm">X</a> <a href="https://www.instagram.com/syntax_fm/">Instagram</a> <a href="https://www.tiktok.com/@syntaxfm">Tiktok</a> <a href="https://www.linkedin.com/company/96077407/admin/feed/posts/">LinkedIn</a> <a href="https://www.threads.net/@syntax_fm">Threads</a>
Wes: <a href="https://twitter.com/wesbos">X</a> <a href="https://www.instagram.com/wesbos/">Instagram</a> <a href="https://www.tiktok.com/@wesbos">Tiktok</a> <a href="https://www.linkedin.com/in/wesbos/">LinkedIn</a> <a href="https://www.threads.net/@wesbos">Threads</a>
Scott: <a href="https://twitter.com/stolinski">X</a> <a href="https://www.instagram.com/stolinski/">Instagram</a> <a href="https://www.tiktok.com/@stolinski">Tiktok</a> <a href="https://www.linkedin.com/in/stolinski/">LinkedIn</a> <a href="https://www.threads.net/@stolinski">Threads</a>
Randy: <a href="https://twitter.com/randyrektor">X</a> <a href="https://www.instagram.com/randyrektor/">Instagram</a> <a href="https://www.youtube.com/@randyrektor">YouTube</a> <a href="https://www.threads.net/@randyrektor">Threads</a>

Podurama

Home

Trending

Personal

Your Podcasts

New Episodes

My Files

Favourite Episodes

Tags (Folders)

Recently Played

Bookmarks

Followed Playlists

1004: TanHacked

Syntax - Tasty Web Development Treats

AI Chapters

AI Insights

Reviews