S socket.dev Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised A lot of blogs on this are AI generated and such as this is developing, so just linking to a bunch of resources out there:Socket:- Sep 15 (First post on breach): https://socket.dev/blog/tinycolor-supply-chain-attack-affect...- Sep 16: https://socket.dev/blog/ongoing-supply-chain-attack-targets-...StepSecurity – https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-p...Aikido - https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-...Ox - https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hi...Safety - https://www.getsafety.com/blog-posts/shai-hulud-npm-attackPhoenix - https://phoenix.security/npm-tinycolor-compromise/Semgrep - https://semgrep.dev/blog/2025/security-advisory-npm-packages... 1233 points jamesberthoty 1 year ago 1019 comments
Socket:
- Sep 15 (First post on breach): https://socket.dev/blog/tinycolor-supply-chain-attack-affect...
- Sep 16: https://socket.dev/blog/ongoing-supply-chain-attack-targets-...
StepSecurity – https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-p...
Aikido - https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-...
Ox - https://www.ox.security/blog/npm-2-0-hack-40-npm-packages-hi...
Safety - https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
Phoenix - https://phoenix.security/npm-tinycolor-compromise/
Semgrep - https://semgrep.dev/blog/2025/security-advisory-npm-packages...