Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised(socket.dev)
1182 points by jamesberthoty | 965 comments
StepSecurity blog post reporting that @ctrl/tinycolor and 40+ npm packages were compromised by self-propagating malware that steals cloud credentials.
























![Screenshot of mccue.dev: Public static void main(String[] args) is dead](https://hn.urlbox.com/shots/renders/2025/9/16/ed092b1a-177d-47de-84aa-74a68088efa1.jpg)





















![Screenshot of thelearningjourneyebooks.com: The Linux Process Journey (2023) [pdf]](https://hn.urlbox.com/shots/renders/2025/9/16/6294a6d7-174f-4634-9aae-df6ea1795b86.jpg)












