1004: TanHacked

Scott and Wes break down the “Mini Shai-Hulud” supply chain attack that compromised TanStack and other popular npm packages through a clever GitHub Actions cache poisoning exploit; a self-propagating worm that stole credentials and persisted through Claude Code hooks and VS Code tasks. They also cover how developers can protect themselves using pnpm’s security defaults, dev containers, and other practical defenses. Show Notes 00:00 Welcome to Syntax! 00:25 Understanding the Shai-Hulud Worm Post Mortem of Shai Hulud Attack 02:47 Mechanics of the Attack: GitHub Actions and Cache How the attack happened Who Was Involved in the Attack Several npm latest releases are compromised Socket.dev Step Security 05:44 Brought to you by Sentry.io 06:09 Propagation and Impact of the Worm 09:30 Preventative Measures for Developers Dead Man’s Switch 12:33 The Role of Package Managers in Security Block Exotic Subdeps 18:39 Using Dev Containers Why You Should Use Dev Containers Scott Tolinski’s Security Review 20:57 Conclusion and Final Thoughts Sentry has Skills! Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott: X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Scott Tolinski?

  Tanstack got tan hacked. Vercel got their walled garden penetrated. After stealing content for years, Udemy got their content stolen. Uh, Lovable, they got their vibes snatched. And now NPM and PyPy have been hit with a major supply chain attack targeting several popular JavaScript and Python packages. This is ShyLaBoof, I mean, uh, ShyHaleed, which is the latest worm in a series of ShyHaleed worms. The, uh, original ShyHaleed worm showed up back in September 2025, which feels like a century ago at this point.

• 0:43Scott Tolinski?

  And where malicious versions of multiple popular packages were published to NPM, they contained the post-install script that harvested sensitive data, uh, and sent it to GitHub public repos named ShyHaleed. So that's why we have the name ShyHaleed here. I also think that's a Star Wars thing. ShyHaleed.

• 1:03Wes Bos?

  That's a sick hardcore band. If you're into hardcore music, look up ShyHaleed. Sick band.

• 1:08Scott Tolinski?

  It's, it's actually from, it's actually from the movie, uh, Dune, by the way, in case you were wondering. We're just gonna, just gonna run through, uh, pissing off people here. The new ShyHaleed 2.0 dropped in November 2025, and, uh, Posthog got their hog posted. And, uh, Zapier got zapped. And Postman also got their hog posted with the new ShyHaleed. And then it struck again, ShyHaleed 3.0 in December of 2025. And now, I don't know why they don't call this one ShyHaleed 4.0, but this is Mini ShyHaleed. Yes, this is Mini ShyHaleed. Yes, right, it is mini. It's a little mini worm. Uh, Wes, uh, ShyHaleed.

• 1:52Scott Tolinski?

  Is a worm in Dune, just in case you want to get the reference if you've never seen the Dune movie, which I assume you have.

• 1:58Wes Bos?

  No, sounds dumb. This is insane. We're going to go through what happened, how it happened, what did it do and how you can protect yourself. But like, man, I'm tired. This seems to be happening every single day and how it happened is actually nuts. So what happened? The publishing sequence of Tanstack, all of the Tanstack packages, along with several other packages in the ecosystem were compromised and they were able to publish a new update of the package that then had like a post install script in it and then that went and harvested credentials. But how it actually happened, this was not like some maintainer got his like password

• 2:40Wes Bos?

  stolen or something was wrong on their computer and it lifted credentials. How it actually happened was was absolutely nuts. So what happened was GitHub actions have caches and when you send in a pull request to a repo, that repo may have several GitHub actions that are in there. So in the case of Tanstack, they had ones that would check the bundle size, make sure you're not accidentally sending in a pull request that's making the bundle size much bigger. And then there was other ones that would like check speed, you know, there's, often there's things that will simply just run every single time that someone sends in a pull request. And then there's other ones that are a little bit more elevated, which is like you don't actually want to, like for example, if someone were to pull requests against a syntax website,

• 3:23Wes Bos?

  we would have to approve that before it actually did a pull request deployment because they could be sending in code that would would do malicious stuff. But what happened here is they took advantage of the fact that these GitHub actions have a shared cache. And I guess when you're making a GitHub action, there is a pull request, you can either have a pull request hook or a pull request target. And when you use pull request target, they then have a shared cache between other ones. And this took advantage of that by poisoning the PNPM store directory. So it built a brand new thing and then it took.

• 4:04Wes Bos?

  It's malicious code and injected it into the PNP M store in a place where when something legitimate was merged, that the sort of the elevated release dot YML workflow would run and it would it would know to actually look up this thing and run it. So they poisoned the PNP M store cache and then turns out they just deleted all the code and then closed the repo, but that PNP M store cache was still poisoned. Then when a legitimate thing was merged, the release GitHub action was run and it looked it up, it had the poison cache and it ran this script that was in there.

• 4:45Wes Bos?

  It that then failed. However, in the like cleanup code of it failing, it was able to capture what's an OID C token essentially just like a JSON web token for NPM. And then that was, that was how they were able to then capture a legitimate NPM published token that can then be used to publish anything. Once you have that, you can then, then you can go ahead and publish more compromised software straight to NPM, which is nuts. Like, like, I'll say this again, this was not somebody getting any of their credentials token stolen at all. It was simply just somebody using the fact that they realized you could, the pull request target was a potential target, right?

• 5:31Scott Tolinski?

  Yeah, yeah, yeah. And this has been a known thing. I mean, this is something that, again, the original Shai Hulud did as well, I believe. So this is not a new attack surface. And I know that like the Sentry folks have like security review AI skills and I'll link to those below, but in their security review AI skill that's been there for us is do not use this particular pull request target. I actually did a quick search on all my repos because I've vibe coded enough GitHub actions because I sincerely hate writing GitHub actions. And I was like, ah, maybe I do have this somewhere, but I don't like.

• 6:09Wes Bos?

  Man, and the crazy thing about this is. It was like, like it was a worm. So once one of them was compromised, it was able to self propagate and publish through other packages. And then it sort of just like ate its way through the ecosystem and eventually got its way into like the Python package management system as well, which is absolutely nuts to see.

• 6:33Scott Tolinski?

  Yeah. Yeah. And it's again, you know, we're talking about Tanstack here. This has hit a lot of packages this morning. And this is just at the time of recording this, a ton, not only just the Tanstack. There's a ton of UiPath packages, which I had never heard of UiPath before. But they have a lot of packages and they got hit. Other popular packages are some, shoot, what was the one that I was, oh, Mistrial?

• 7:00Wes Bos?

  Mistral.

• 7:01Scott Tolinski?

  Mistral? Mistral? I always call it Mistrial. I don't know why. Mistral. Mistral got hit. Cmox Agent MCP. There's just a number of, of different packages that got hit that. So this is not just, are you using Tanstack or not? And I would imagine by the time all is said and done here, there will be even more.

• 7:22Wes Bos?

  One interesting thing about the, the worm is that it tried to inject itself into other places that would auto run. So like, like at the end of the day, once this thing was published to, to the thing, like, once the end user would then install it, it would have like a, a post install script that it would install from like a different location. And, and then it, and then it would run some stuff and try to harvest credentials. So it was looking, sorry, I'm, I'm really, really blown out on my camera here. It would, it would try to harvest like different credentials from AWS and what it just looking for stuff on your computer. I'm sure that there was some end game here, probably half for, we need more compute

• 8:03Wes Bos?

  to run our hacks on, and then half for, we're actually looking for compromised information. But one thing it did do is it stuck stuff into other places that will automatically run code. So it stuck it into the Claude settings JSON and the VS Code tasks JSON, which when you fire up Claude or fire up VS Code, this will automatically execute.

• 8:25Scott Tolinski?

  Yeah, I mean, this is how worms operate, right? They move from place to place, they dig themselves in.

• 8:32Wes Bos?

  Worms are not this fast.

• 8:33Scott Tolinski?

  I mean, there's a reason why.

• 8:34Wes Bos?

  This is nuts. But another crazy thing is that the hackers installed a dead man switch. So if you did end up installing this thing on your computer, it would constantly ping out to the GitHub API to see if your GitHub token had been rotated, or if you had revoked your GitHub token. And if you had revoked your GitHub token, it would run rm, rf on your home directory.

• 8:59Scott Tolinski?

  Oh.

• 9:00Wes Bos?

  Oh. Yeah.

• 9:02Scott Tolinski?

  Oh. Yeah, that that stuff is freaky because I feel like there's just so many people who would not even know that this was on their machine. Maybe it's on their machine, they run it and then goodbye to your life there. Man, that is a... Yeah, it's a scary thing to think about. And that dead man switch is, it's ruthless, is what it is.

• 9:28Wes Bos?

  Have backups, folks, have backups. Let's talk about like, how do you actually protect yourself? So if, to stop this thing from happening you... Like, I think like, partially on the like maintainer side, obviously, don't use that pull request target in your GitHub action, right? Like, I feel for all the folks that work on Tansac because they have done so much to make sure that they were secure. But it wasn't even that, like, somebody's computer was hacked. It was simply just some, this like poisoning of a shared cache, which is nuts to think about. But like, on like a user point of view, you know, like, how do you... We're...

• 10:09Scott Tolinski?

  Well, let's stick on the maintainer for just a second.

• 10:11Wes Bos?

  Yeah.

• 10:12Scott Tolinski?

  So obviously, don't use that. There is a set of security review skills from the Sentry team that are really worth checking out. I also use those in my S stack skill tree. So if you're using AI, the security reviewer skill can definitely help if you are using AI for stuff. There's also a GitHub Actions scanner made by SNYK Labs, who does a lot of... Snick Labs does...

• 10:41Wes Bos?

  Yeah, Scott doesn't know how to pronounce anything today.

• 10:45Scott Tolinski?

  I just say SNYK. I just, I just, that's not a word to me. That's a fake word. Snick, from Snick Labs, this, uh, this will scan your GitHub actions for security issues, which they do great work over there. So that's an awesome thing to have in your tool.

• 11:02Wes Bos?

  There's, there's a kind of like three big companies in this space right now. There's, there's six, Snick Security, there's Socket Dev, which we've, we've had on the podcast. And then there's also the folks that did actually sort of release the thing was Step Security. So I saw Socket, they, Socket basically scans every single NPM package that is ever published. And then they have whole, we talked to Feras about how he does it, right? They have a whole bunch of stuff that they look for common things. They look for obfuscated code. They look for, they have a whole list of things to actually look for. And their system was able to detect it within six minutes, he said, which is, is great. And you, you have to wonder like, why is, why is NPM not doing this?

• 11:48Wes Bos?

  You know, I think something, something's got to change in this. This was not really an, an NPM issue, but also like, this is, is such a big ecosystem. Absolutely everything uses NPM these days and it's such a huge target.

• 12:07Scott Tolinski?

  Yeah.

• 12:07Wes Bos?

  That they're obviously going to be targeted by these, these hackers. So I really think NPM needs to step up here and implement some, some bigger, bigger things. Because they would, they have like two factor authentication now every time you want to publish something. And then that seems to be like the only thing they've done in the last little while. I'm sure they've done more, but like, they really need to be doing something like Step Security or Socket's doing.

• 12:33Scott Tolinski?

  Yeah. From as a, as a user though, as a consumer of NPM packages, and let me tell you, open up wide, uh, because you're getting gigabytes of NPM packages on your machine.

• 12:45Scott Tolinski?

  What can we do to help ourselves here? I think one of the things that people have been kind of going around and talking about is the minimum release age settings. I use PNPM instead of NPM as my package manager and PNPM has this on by default. So if you are a PNPM user, by default in the latest version, only packages that are 24 hours old can be installed. So that's one thing. PNPM actually also has a, it blocks scripts from running by default. There's like a very annoying thing that pops up and you have to approve the scripts. Well, this is why you have to approve the scripts from running. It's there to save you.

• 13:28Scott Tolinski?

  So PNPM can feel obnoxious at first, but again, that is saving your ass. And also PNPM isn't the only package manager with this minimum release age setting. All of them have it, but they don't have it on by default. So yarn, yarn has it with NPM minimal age gate, minimum release age in bun and min hyphen release hyphen age in NPM RC, which can we just, these are like, we got, we got a hyphenated case here, we got camel case, we got all four different, can we just agree on a property name for this setting?

• 14:09Scott Tolinski?

  Like who, who decided that NPM minimal age gate was a good property, property name for that setting? That's, that's ridiculous.

• 14:17Wes Bos?

  PNPM.

• 14:18Scott Tolinski?

  Let's just all standardize on the minimum release age.

• 14:20Wes Bos?

  PNPM also has another setting, which is turned on in version 11, which is relatively new. So if you're using an older version of PNPM, which I think a lot of people probably are, it's called block exotic sub depths, which sounds kind of nice, but essentially.

• 14:36Scott Tolinski?

  It sounds cool.

• 14:37Wes Bos?

  With your package JSON, you obviously can link to NPM packages and you say, okay, I want version. I want low dash version eight, right? But that's not the only way to say where these packages come from. You can also link to specific Git commits. You can link to simply just external tarballs. And that was, that's what was happening here where when you installed it, it simply was, was linking to a dependency that lived on GitHub. So this, this, even if this, like this malicious code was not actually published to NPM. It was just linking off to like a, like a Git repo somewhere. And then the, when you NPM install, then it just goes and downloads that code

• 15:22Wes Bos?

  from the actual resource. So this block exotic sub depths, when it's turned on, will not allow you to, to have those things that are not inside your package JSON, inside of your root package JSON. So like, that's often the thing is I like eight levels deep of your package JSON. There's some tiny little dependency that half the world is dependent on. That thing gets compromised. And then all the way up the package chain, everything is, is compromised. So that's another little step. And I think that's, PMPM is doing a great thing for the, the community here by just turning these things on by default.

• 16:04Scott Tolinski?

  Yeah. It kind of feels like they're the only ones who care enough to turn those things on by default.

• 16:09Wes Bos?

  Yeah. I don't know. I think also like NPM has so many users that I'm sure they say, well, if we turn this on, it's going to break so many things. Like, I'm sure they, they have like 100 times the traffic and 100 times the users. And like PMPM is used mostly by highly technical users. But you have to think like, NPM is used in like Home Assistant and in everyone's vibe coded apps. Like, I'm sure half the people using NPM have no idea what NPM is. And I'm sure if they flip any of these switches, it will just break a certain subset of, of, of people's apps.

• 16:49Scott Tolinski?

  Yeah, I mean, I hear you on that, but like you have to wonder if these types of hacks are specifically targeting vibe coders who don't, they just tell their agent to do whatever their agent installs a whole ton of stuff and then they are none the wiser.

• 17:06Wes Bos?

  I think it's targeting anyone they can get, get access to, right?

• 17:09Scott Tolinski?

  Like, I think it's targeting anyone they can get access to, but in the same regard, I feel like these things are way more likely to succeed with systems that are just installing things.

• 17:22Wes Bos?

  Yeah.

• 17:22Scott Tolinski?

  Without.

• 17:23Wes Bos?

  Oh, yeah.

• 17:24Scott Tolinski?

  The user really knowing what they're bringing into their.

• 17:27Wes Bos?

  Well, I don't know, like, I don't think that, like, would, would this have got me? Um, if I NPM installed something, if I NPM 10 stack at the wrong time yesterday, it probably would have got me.

• 17:39Scott Tolinski?

  Oh, yeah.

• 17:39Wes Bos?

  You know?

• 17:40Scott Tolinski?

  Totally.

• 17:41Wes Bos?

  And I think I was just lucky that.

• 17:43Scott Tolinski?

  I'm not saying exclusively.

• 17:45Wes Bos?

  Something and like you have these PMPM stuff installed in there, but sometimes you NPM install something or sometimes you, you have an agent RIP on a script and it uses NPM. So I, I think I certainly could have got God by this type of thing.

• 17:58Scott Tolinski?

  I think anybody could get God for sure. Uh, yeah, I'm just wondering if like, if, hmm, if, if the susceptibility is a higher.

• 18:09Wes Bos?

  Oh, yeah.

• 18:10Scott Tolinski?

  Is higher.

• 18:10Wes Bos?

  Definitely, and like, they're probably looking for people inside of organizations that are like, like vibe coding, like apps to, to get their work done, you know? Like somebody that works at the power plant just whipped up a script to reply to their emails and then bam, you know, now that, now they're in at the, you gotta think like they're probably looking for something deeper or and/or they're looking for compute so they can, they can do more stuff.

• 18:40Scott Tolinski?

  Yeah, yeah. And another thing you can do here, folks, is if you want, uh, you can start using dev containers. CJ, uh, made a really great video called, "You Should Be Using Dev Containers", explaining how to get set up with dev containers. Um, that could help with the sandbox nature. Of this all right. If this script had access to remove your home directory, if it's inside of a container, you're you're a bit safer there. So dev containers are certainly something that can at least protect your home system. Because again, it is, we've talked about this before, but it's wild that so many of us are just YOLO running, you know, you install NPM and all of a sudden, a bunch of stuff's being run on your computer and you

• 19:24Scott Tolinski?

  probably don't know it like that's, that's when you, I mean, when you think about it, that's crazy. That's crazy that anybody would agree to that. If you were given a prompt, it's like, you, you, I don't know, like, I, yeah, I don't know. It reminds me of like, Little Snitch. Remember Little Snitch?

• 19:41Wes Bos?

  That's, that's the thing is that there's, there's gotta be some middle ground between, I don't want to have to prove every little thing. Little Snitch is annoying. But

• 19:52Scott Tolinski?

  Little Snitch for people who don't know is a software that, that scanned your network and like, tried to approve or deny like every network request coming out of your machine. It was really super useful when you were absolutely not pirating Adobe Photoshop.

• 20:10Wes Bos?

  And like Dino does this. Dino requests you approve every single outgoing network connection and file system access. And the reality is that people don't use that because it's annoying. And they just want to, they want to let it rip. And everybody turns on Claude dangerously skip permissions, you know, or they use something that doesn't even have a security model. So like, there, there's gotta be some sort of something. And I honestly, I think that the, the solution to this is going to be that the model actually will be able to detect it, detect what is possibly malicious and what is totally fine to run. But I think before we get there, we're gonna have a lot more of these hacks.

• 20:51Scott Tolinski?

  Yeah. What's that Mythos? The, the anthropic model?

• 20:57Scott Tolinski?

  You know what? It's funny. I did see a report today, you know, that Mythos that was supposedly this, I'm not saying that Mythos isn't going to be game changing in this regard. I sincerely do not know. But I did see that the Curl folks were like, yeah, Mythos found one security issue, but it also like fake or it also like made up like three of them. So we weren't super impressed. So.

• 21:22Wes Bos?

  I don't know, Curl though. Curl. That's, that's a pretty like hardened, low level tool. And for it to find one thing in such a big thing, that's pretty impressive.

• 21:36Scott Tolinski?

  Listen, I don't, I don't have any, any knowledge on it.

• 21:39Wes Bos?

  Who knows? It could be just drama that they're, they're trying to spread, you know? Like, I don't believe much of what a lot of these people say until you actually see it. But in the same breath, I'll say I'm very impressed at everything that has happened in the last six months. All right.

• 21:53Scott Tolinski?

  Yes. Yeah. Well, uh, what do you, when do you think the next hack is going to be?

• 21:57Wes Bos?

  Oh my gosh, I'm tired. I'm tired. I don't want anymore.

• 22:00Scott Tolinski?

  Or?

• 22:01Wes Bos?

  One other thing is the socket has a CLI, which you can like socket npm install. And it just kind of sits in front of your npm command and that will sort of hook into this type of thing. Because like if socket finds it, but you, they haven't ripped it out of npm yet. Then you're, you're still going to get got. So I honestly, I don't use this myself. I probably should be now that I'm looking at it.

• 22:27Scott Tolinski?

  Yeah. I think that's the name of the game is I don't use this or do this myself, but I probably should be.

• 22:34Scott Tolinski?

  Here's something that you might not be using, but you definitely should be is Sentry at sentry.io. Sentry is awesome for finding bugs, issues, errors, rage clicks, slow parts of your apps. It's really an essential toolkit for you to understand what the heck is going on in your application. Whether that is with logs, errors, performance, any of that stuff. It even allows you to monitor things like your agents. So that way you can make sure your spend is under control with how you're using agents. And Sentry just gets new features all the time. So check it out as sentry.io.

• 23:12Wes Bos?

  Beautiful. All right. Thanks for tuning in.

• 23:14Scott Tolinski?

  Peace.