9 ms·

Does anyone happen to have a grep or similar that helps me check if this is showing up anywhere in the trillions of files in node_modules (or pnpm store)?

rhdunn 1mo ago
The what happened section mentions the addition of the `setup.mjs` and `Math_Symbol.js`, along with a change in `package.json` to add `"preinstall": "node setup.mjs"`, so presumably checking for any of those would be a good indication to check further. For example: find . -type f | grep -P "/Math_Symbol\.js$"
- yread 1mo ago
  Crucially, Math_Symbol.js that is almost 800KB, not the innocent 1KB one from regenerate-unicode-properties
  - somebudyelse 1mo ago
    when i was searching i got a heartattack when i saw Math_Symbol.js. Thankfully my agent was able to figure it out.
orheep 1mo ago
find . -type d -name node_modules -prune -exec find {} $ -name setup.mjs -o -name math_init.js -o -name Math_Symbol.js $ \; 2>/dev/null
byutifu 1mo ago
This article has a lot of information and ways to check & clean: https://safedep.io/keyv-npm-supply-chain-compromise/ https://safedep.io/keyv-npm-supply-chain-compromise/
- somebudyelse 1mo ago
  I ended up asking my agent with auto mode: can you search all installed node modules for any sign of the shai hulud supply chain attack? What happened Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a "preinstall": "node setup.mjs" entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed. setup.mjs is a heavily obfuscated dropper. Its only job is to silently download the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ and use it to execute the real payload, Math_Symbol.js: execFileSync(<bun binary>, ['<script_dir>/Math_Symbol.js'], { stdio: 'inherit', cwd: <script_dir> }) The Math_Symbol.js is a heavily obfuscated 728 KB JavaScript file containing credential stealers that harvest secrets from the victim's environment, encrypt the findings, and exfiltrate them to a public GitHub repository whose description reads "Shai-Hulud: Here We Go Again". The payload also contains worm-like propagation functionality to infect packages of other maintainers that have installed one of the compromised packages.
  - mplewis 1mo ago
    No one wants to see slop that you pooped out of an LLM butt
chime 1mo ago
Highly recommend `fd` for the sheer speed: fd -HI "^(setup\.mjs|Math_Symbol\.js|math_init\.js)$" 1. https://github.com/sharkdp/fd https://github.com/sharkdp/fd 2. `brew install fd`

rhdunn 1mo ago

The what happened section mentions the addition of the `setup.mjs` and `Math_Symbol.js`, along with a change in `package.json` to add `"preinstall": "node setup.mjs"`, so presumably checking for any of those would be a good indication to check further. For example: find . -type f | grep -P "/Math_Symbol\.js$"

yread 1mo ago
Crucially, Math_Symbol.js that is almost 800KB, not the innocent 1KB one from regenerate-unicode-properties
- somebudyelse 1mo ago
  when i was searching i got a heartattack when i saw Math_Symbol.js. Thankfully my agent was able to figure it out.

orheep 1mo ago

find . -type d -name node_modules -prune -exec find {} $ -name setup.mjs -o -name math_init.js -o -name Math_Symbol.js $ \; 2>/dev/null

byutifu 1mo ago

This article has a lot of information and ways to check & clean: https://safedep.io/keyv-npm-supply-chain-compromise/ https://safedep.io/keyv-npm-supply-chain-compromise/

somebudyelse 1mo ago
I ended up asking my agent with auto mode: can you search all installed node modules for any sign of the shai hulud supply chain attack? What happened Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a "preinstall": "node setup.mjs" entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed. setup.mjs is a heavily obfuscated dropper. Its only job is to silently download the Bun JavaScript runtime from github[.]com/oven-sh/bun/releases/download/bun-v1.3.13/ and use it to execute the real payload, Math_Symbol.js: execFileSync(<bun binary>, ['<script_dir>/Math_Symbol.js'], { stdio: 'inherit', cwd: <script_dir> }) The Math_Symbol.js is a heavily obfuscated 728 KB JavaScript file containing credential stealers that harvest secrets from the victim's environment, encrypt the findings, and exfiltrate them to a public GitHub repository whose description reads "Shai-Hulud: Here We Go Again". The payload also contains worm-like propagation functionality to infect packages of other maintainers that have installed one of the compromised packages.
- mplewis 1mo ago
  No one wants to see slop that you pooped out of an LLM butt

chime 1mo ago

Highly recommend `fd` for the sheer speed: fd -HI "^(setup\.mjs|Math_Symbol\.js|math_init\.js)$" 1. https://github.com/sharkdp/fd https://github.com/sharkdp/fd 2. `brew install fd`