TaggartThis is a big deal. Already seeing evidence of this by way of OpenClaw installations.
The malware has been pulled by NPM, but because of the package version, Defender and other endpoint security tools may alert on OpenClaw installations as of right now.
[Bug]: Running official install command triggers Windows Defender - malicious batch file and registry keys added · Issue #58140 · openclaw/openclaw
Bug type Behavior bug (incorrect output/state without crash) Beta release blocker No Summary When running the official installation command from https://openclaw.ai, malicious changes are made to y...
Christoffer S.@mttaggart I'm thinking that this is too big... this must be more than what the attackers can handle, no?
It's absolutely bonkers in size, and the amount of affected orgs... it's hard to grasp the entirety of it all. Jesus fucking christ.
@nopatience Luckily it's only a couple of versions, but still gnarly.
@nopatience Exceeeept it's used in OpenClaw installs https://github.com/openclaw/openclaw/issues/58140
@mttaggart I guess... time will tell the impact this will have. But I can't help but think... how many will NOT know that they are affected? I mean... there's a lot of YOLO "coders" out there with absolutely zero idea of CI/CD security.
I mean... I'm probably close to being one of them. Fuck... I'm just like them. As a hobby coder I don't really have protection against this.
I don't pull new packages ... that's it, I have a 7 day limit on updating packages... anyway, I digress.
@nopatience This is where tools like Trivy can help—oh wait
@mttaggart Imagine that... being more secure for not using vulnerbility scanners.
There's... a certain level of obvious irony in that.
scottley@mttaggart thank you! Appreciate the sharing!!!
@mttaggart looks like npm delisted the vulnerable versions quickly...
@scottley Yep, and the staged malware dependency. No longer an active threat, but a hunting project. It's such a pain that this can hit a CI/CD pipeline if it runs at the wrong time.
@mttaggart i have to cover my devs, my servers, my customers... having npm dive on the grenade says a lot... that is enormous... they learned a lot from Shai Halud. Package providers have a much bigger responsibility than they expected...
Robin Palotai@mttaggart not that anyone cares, but I strongly consider returning to old-school SSR-only pages, without any (or at most a pageful of libless) JS.
Looking at you, #htmx