Top all-time · #1196
Aikido Security's Blog
Company blog · aikido.dev/blogsecurityprogramming
Aikido Security's Blog is the company blog at aikido.dev, writing about security and programming. Since 2023, 57 different Hacker News readers have linked it 69 times, most often “NPM debug and chalk packages compromised”. It is still writing: the last post was on 2026-11-02, and you can follow it by feed.
Continuous, autonomous security that gets developers back to building.
Most-linked posts?
- NPM debug and chalk packages compromised8 people · 9 mentions · first linked 2025-09-08
- Self-Replicating NPM Package Supply Chain Worm 'Shai Hulud'3 people · 3 mentions · first linked 2025-09-16
- Security assessment found open model near frontiers2 people · 2 mentions · first linked 2026-08-21
- Safe Chain: Stopping Malicious NPM Packages Before They Wreck Your Project2 people · 2 mentions · first linked 2025-09-17
- Prompt injection through GitHub Action workflow impacts Gemini and others2 people · 2 mentions · first linked 2025-12-04
- Fake Clawdbot VS Code Extension Installs ScreenConnect Rat2 people · 2 mentions · first linked 2026-01-28
- PyPI package telnyx has been compromised in yet another supply chain attack2 people · 2 mentions · first linked 2026-03-27
- Send GitLab an email, push to main2 people · 2 mentions · first linked 2026-09-25
- Popular NX packages compromised on NPM2 people · 2 mentions · first linked 2025-08-27
- Google API keys keep working after you delete them2 people · 2 mentions · first linked 2026-05-21
What Hacker News says?
The phishing email comes across a bit too amateur. Specifically the inclusion of: "we kindly ask that you complete this update your earliest convenience". The email was included here: https://cdn.prod.website-files.com/642adcaf364024654c71df23/... From this article: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com...
Comment linking /blog/npm-debug-and-chalk-packages-compromised
on “NPM debug and chalk packages compromised”Submitted NPM debug and chalk packages compromised as a story · 1372 points
HN discussionTips to protect yourself from supply-chain attacks in the JavaScript ecosystem: - Don't update dependencies unless necessary - Don't use `npm` to install NPM packages, use Deno with appropriate sandboxing flags - Sign up for https://socket.dev and/or https://www.aikido.dev - Work inside a VM
Comment linking /
on “NPM debug and chalk packages compromised”Submitted Shai Hulud launches second supply-chain attack as a story · 352 points
HN discussionThis looks pretty bad. Even if this only affects crypto wallets, I can't help but imagine how much worse this could be. Another good read is at https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com...
Comment linking /blog/npm-debug-and-chalk-packages-compromised
on “NPM debug and chalk packages compromised”Submitted Offical XRP NPM package has been compromised and key stealing malware introduced as a story · 55 points
HN discussionThe chalk/debug one https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com... I believe socket also found it this way just a bit later. The dev later said that Charlie notifying him probably shaved off some very important time for the remediation. So in this case 2 different companies found it using automated tech before anyone else
Comment linking /blog/npm-debug-and-chalk-packages-compromised
on “Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised”Submitted Safe Chain: Stopping Malicious NPM Packages Before They Wreck Your Project as a story · 16 points
HN discussionAccording to Aikido Security the attack has now targeted 180+ packages: https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-...
Comment linking /blog/s1ngularity-nx-attackers-strike-again
on “Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised”Submitted Node2Shell: Node.js Brotli vulnerability allows remote code execution as a story · 14 points
HN discussionMore: SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting...
Comment linking /blog/shai-hulud-strikes-again-hitting-zapier-ensdomains
on “Shai-Hulud Returns: Over 300 NPM Packages Infected”Submitted PyPI package telnyx has been compromised in yet another supply chain attack as a story · 14 points
HN discussionThe full payload is available here if you want to do analysis, etc: https://www.aikido.dev/blog/popular-nx-packages-compromised-...
Comment linking /blog/popular-nx-packages-compromised-on-npm
on “Malicious versions of Nx and some supporting plugins were published”Submitted Malware hiding in plain sight: Spying on North Korean Hackers as a story · 8 points
HN discussionOk, we've belatedly changed to that from https://www.aikido.dev/blog/python-packages-vulnerable-node2... . I'll put the other link in the top text as well.
Comment linking /blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
on “Broccoli2Shell: Brotli decoder RCE in Node.js, Python and more”Submitted Aikido launches infinite pentesting – Automated pentesting on every release as a story · 7 points
HN discussionIs this related to npm debug and chalk packages being compromised? https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com...
Comment linking /blog/npm-debug-and-chalk-packages-compromised
on “DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware”Submitted RATatouille: A Malicious Recipe Hidden in rand-user-agent as a story · 6 points
HN discussionQuite possibly - there have been several incidents recently and a number of researchers working together so it’s not clear exactly who found something first and it’s definitely not as simple to fix as tossing a tool in place. The CEO of socket.dev described an automated pipeline flagging new uploads for analysts, for example, which is good but not instantaneous: https://news.ycombinator.com/item?id=45257681 The Aiki…
Comment linking /blog/npm-debug-and-chalk-packages-compromised
on “Pnpm has a new setting to stave off supply chain attacks”Submitted Popular code generator for TanStack Query hit by supply chain worm as a story · 5 points
HN discussionNot really, app sec companies scan npm constantly for updated packages to check for malware. Many attacks get caught that way. e.g. the debug + chalk supply chain attack was caught like this: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com...
Comment linking /blog/npm-debug-and-chalk-packages-compromised
on “Pnpm has a new setting to stave off supply chain attacks”Submitted Keyv and friends compromised in active Shai-Hulud supply chain attack as a story · 5 points
HN discussionThis is a better article: https://www.aikido.dev/blog/python-packages-vulnerable-node2... and this is the actual CVE report, which doesn't say much: https://www.cve.org/CVERecord?id=CVE-2026-111497
Comment linking /blog/python-packages-vulnerable-node2shell-brotli-cve-2026-111497
on “Evolving Threat: http2shell is an RCE in Node, Python, and more”Submitted I wrote Gitleaks, now I'm maintaining Betterleaks as a story · 5 points
HN discussionIt's probably related to the issue published by aikidolabs where leaked per-user gitlab issued emails were being used as a sort of credential. https://www.aikido.dev/blog/gitlab-email-push-to-main
Comment linking /blog/gitlab-email-push-to-main
on “GitLab Outage”Submitted The State of SQL Injection Today as a story · 5 points
HN discussionThread on the post from main rust blog: https://news.ycombinator.com/item?id=49372853 Direct post link: https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on... Initial report: https://github.com/rustsec/advisory-db/issues/3161 Other vendor posts: * https://www.stepsecurity.io/blog/arrayref-rust-crate-supply-... * https://research.jfrog.com/post/arrayref-proc-macro1-crates-... * https://www.aikido.dev/blog/tw…
Comment linking /blog/two-popular-rust-crates-arrayref-and-append-only-vec-compromised-in-supply-chain-attack
on “Malicious Rust Crate Arrayref Runs a Build-Time Payload”Submitted Anthropic's Fever Dream: Claude's package that stole real keys as a story · 4 points
HN discussionA blog post: https://www.aikido.dev/blog/npm-debug-and-chalk-packages-com... ( https://news.ycombinator.com/item?id=45169657 )
Comment linking /blog/npm-debug-and-chalk-packages-compromised
on “NPM package 'debug' v4.4.2 contains malware”Submitted Prompt injection through GitHub Action workflow impacts Gemini and others as a story · 4 points
HN discussion
