npm supply-chain worm
- https://www.youtube.com/watch?v=Ws-Nc9S8i_Y
- Original title: It just keeps getting worse
Prime reacts to another npm supply-chain worm — "mini Shai-Hulud" — that compromised 42 TanStack packages plus Mistral AI, UiPath, OpenSearch, Guardrails AI, Draft Lab and others. The attack hijacked OIDC tokens from GitHub Actions runners and poisoned the Actions cache to publish malicious versions through legitimate CI/CD, so the releases looked properly signed. Uses the incident as a springboard for a philosophical rant about package-manager culture.
Worms are not a JS-only problem
- Rust isn't safe by virtue of being Rust: `build.rs` runs on build, so a malicious dep poisons you the moment you compile.
- Ruby pulled 120 malicious gems the day before. PyPI also got hit by the same worm. This is ecosystem-wide.
Defensive PSAs
- Use pnpm; set a minimum release age so you don't grab brand-new versions (trade-off: you also skip new security fixes — damned either way).
- Block install scripts by default.
- Pin versions, but transitively-pinned deps may still resolve to ranges. Self-hosting your own registry gives more control.
The deeper rant: package managers are evil
References Ginger Bill (Odin author): the convenience of `npm install` hides how much code you're adopting as a liability. Every dep = interface churn, forced upgrades, security exposure, code you never read (his poll: 80%+ never review dep code, suspects it's higher).
Batteries-included languages as an alternative
Prime is rewriting Mordoria in Odin / Jai. Odin ships vendored libraries (Raylib for 2D graphics, libc, Lua, x11, curl, wasm, WebGPU) — a "complete" language for game/graphics work with no package manager. Go gets a similar nod: dependencies don't ruin your weekend, and `go mod vendor` copies them into your tree.
Why JS got here
JavaScript was built for the DOM, then drifted into general-purpose use without ever deciding what it should be. Result: everything is a third-party package, every package pulls 100+ transitive deps, and the worm-surface is enormous. He expects Shai-Hulud-style attacks every few months indefinitely — "I refuse to believe they don't already have access to a lot of major software companies."
Takeaway
Prefer environments tuned for the task. Vendor deliberately. The cost of pulling a dep should feel high enough that you only do it when you mean it.