PostHog admits Shai-Hulud 2.0 was its biggest ever security bungle

PostHog says the Shai-Hulud 2.0 npm worm compromise was "the largest and most impactful security incident" it's ever experienced after attackers slipped malicious releases into its JavaScript SDKs and tried to auto-loot developer credentials. In a postmortem released by PostHog, one of the various package maintainers impacted …

[Paul Herber]

Shai-Hulud

Shai-Hulud - should definitely be run in a sandbox.

[stiine]

Re: Shai-Hulud

A very large sandbox.

[JLV]

Re: Shai-Hulud

on a remote desert planet, where the locals don't matter much, preferably

[Roger Greenwood]

Re: Shai-Hulud

certainly something to get your hooks into

[ecarlseen]

Totally misunderstood that

I popped over to PostHog's website to read the blog post and for a moment I thought the hack was about replacing the UI on their site with the most godawful abortion imaginable but then realized they somehow decided inflict this on their visitors deliberately. Perhaps some sort of hazing ritual or reverse psychology sales technique?

[Anonymous Coward]

Re: Totally misunderstood that

It would also have helped if at it some point in the article the writer had said who or what PostHog is, what products they make, and why I should care.

I guess it's one of those "If you might need to be concerned, you'll already know who they are" things, but if you're reading this just out of casual passing interest, a little bit of background information really wouldn't hurt, and surely ought to be something that you pick up on the importance of in basic journalism training…

[I ain't Spartacus]

Re: Totally misunderstood that

ecarlseen,

Hoo boy! That website is an abomination!

It's like something perpetrated in the late 90s, on Geocities. But somehow more upsetting, because it's tidy and organised. Which means someone inflicted it on you deliberately! Rather than just being the product of enthusiasm and incompetence, this is the result of a diseased mind!

Picked a product page at random (LLM Analytics) and it's got an upsettingly fluorescent purple title that makes your eyes bleed, and so unable to read the pale grey text beneath.

What is the obsession of modern UI designers with fucking zero contrast pale grey text, on a white background? These guys have even less excuse with their use of high contrast purple.

[breakfast]

Re: Totally misunderstood that

They probably only looked at it in dark mode. Perhaps there's a switch somewhere that lets you change the website background.