1004: TanHacked

1004: TanHacked

0 Anmeldelser
0
Afsnit
1007 of 1008
Længde
23M
Sprog
Engelsk
Format
Kategori
Fakta

Scott and Wes break down the “Mini Shai-Hulud” supply chain attack that compromised TanStack and other popular npm packages through a clever GitHub Actions cache poisoning exploit; a self-propagating worm that stole credentials and persisted through Claude Code hooks and VS Code tasks. They also cover how developers can protect themselves using pnpm’s security defaults, dev containers, and other practical defenses.

Show Notes

00:00 Welcome to Syntax!

00:25 Understanding the Shai-Hulud Worm

Post Mortem of Shai Hulud Attack

02:47 Mechanics of the Attack: GitHub Actions and Cache

How the attack happened

Who Was Involved in the Attack

Several npm latest releases are compromised

Socket.dev

Step Security

05:44 Brought to you by Sentry.io

06:09 Propagation and Impact of the Worm

09:30 Preventative Measures for Developers

Dead Man’s Switch

12:33 The Role of Package Managers in Security

Block Exotic Subdeps

18:39 Using Dev Containers

Why You Should Use Dev Containers

Scott Tolinski’s Security Review

20:57 Conclusion and Final Thoughts

Sentry has Skills!

Hit us up on Socials!

Syntax: X Instagram Tiktok LinkedIn Threads

Wes: X Instagram Tiktok LinkedIn Threads

Scott: X Instagram Tiktok LinkedIn Threads

Randy: X Instagram YouTube Threads


Lyt når som helst, hvor som helst

Nyd den ubegrænsede adgang til tusindvis af spændende e- og lydbøger - helt gratis

  • Lyt og læs så meget du har lyst til
  • Opdag et kæmpe bibliotek fyldt med fortællinger
  • Eksklusive titler + Mofibo Originals
  • Opsig når som helst
Prøv nu
DK - Details page - Device banner - 894x1036
Cover for 1004: TanHacked

Other podcasts you might like ...