Incident Report: CVE-2024-YIKES (opens in new tab)

> As the victim of the one from last year

Background here:

https://news.ycombinator.com/item?id=45169657

https://news.ycombinator.com/item?id=45187528

> The implication that I don't know what I'm looking at, or that I don't know what security is (despite having a clean track record for about 15 years now) was a bit aggravating.

I'm a security geek, a clean track record means much less to me than anyone would expect. The comment from the article mentioning that there was no evidence of exploitation explains why. I would never have noticed that implication, because I don't think it exists. (And it's completely unreasonable if it does), so that's your own deal... it's not a good conclusion to take from the article.

The only thing that matters is how much any given owner cares. Are they willing to go the extra mile to make sure things get done correctly. That's the best signal about if you can trust a project. Seems like you give a shit, so I wouldn't be too hard on yourself. The people that matter can tell, (everyone who can't tell is already willing to lie so they can be safely ignored!)

> In fact, even months later, the lasting effects have been panicking over anything that is remotely suspicious. The most recent example was just a few days ago. Had just gotten on the plane to go on vacation when someone Liked the original "I've been pwned" post on Bluesky. I misread the notification as being a new message to me saying "You've been pwned" and started to panick.

You haven't dealt with it yet, if you want to get your attention back so you can spend it on more important things than worrying about something from the past, you gotta talk to somebody. A therapist would help the fastest, but friends and family are often just as good.

> I'd have had no way to address it and it would have ruined the small chance per year I get to have a break.

Seriously, having been there myself it's not worth it... you're just allowing them to DoS your brain by allowing them to live rent free in your head. The only thing that matters is how seriously you take the remediation. Attention to detail, and the willingness to go the extra mile for security defects to tie up all loose ends is what matters. It's not your job to fix everybody's issue yourself, even if they don't or can't. You still have to enjoy life, or you burn out, and some idiot that doesn't care will take your place. Then they really win.

You're not responsible for the security or stability of anybody using nightly packages. (Only maintainer signed and tagged releases)

> The attack last year wasn't me misunderstanding security. It was the sum of many, many small things

so, a misunderstanding of how the little things actually impact security?

> (my history with and perception of npm especially w.r.t. their security posture and poor outreach over the years, being stressed out overall, and being in a rush at that particular moment, and a few other personal things) coming together in a perfect storm that resulted in the attack.

Those other personal things are the kinda thin that being able to enjoy a vacation make much easier. You can't help anybody if you don't put on your own mask first... Well... You definitely can, you're obviously trying to do now, but it's needless harder.

Npm, and the JavaScript ecosystem is a fucking joke. It's a mistake to blame yourself (or any maintainer) for how difficult it is to meet the bar for both security and accessibility. Worrying about the difficulty in consistentenly demonstrating the perfection required for security is a fool's errand, and your allowing the bad guys to get what they want by letting it live rent free in your head, it won't go away for as long as you worry about it more than you talk about it.

And I say all of that as the person who has multiple times, made the argument that it's perfectly fine to name an engineer and their decisions or incompetence as the root cause analysis in an official incident report. (Pilot Error is a thing): If I thought you were responsible, or had done anything wrong, I'd gladly blame you. Smart people don't care about mistakes, because they are always noise in the signal. I care about effort. People who give a shit are much more important and valuable.

Yeah. Me too. It looked like a spoof when I started reading, but as I went on it didn't seem to be increasing in it's implausibility.

I should have known when the first package was left-justify, but I read until karen before I realized it must be fiction

Would explain why most of the download traffic comes from the Middle East :)

i think i might be missing some reference/joke

obviously it's referencing the left-pad incident[0], and to 'justify' text is another kind of text manipulation[1]; but with the more common definition, i guess it's a joke about justifying something? The Left? idk

[0] https://en.wikipedia.org/wiki/Npm_left-pad_incident

[1] https://en.wikipedia.org/wiki/Typographic_alignment#Flush_le...

Currently a Google search for vulpine-lz4 gives a very serious AI overview.

lmao https://youtu.be/-4-lDiCH0s8 https://youtu.be/ENYYI6eq4w0

pure slopnet

Node's Malicious Packages.

I only noticed at goat farming. But anyway, what would a left-justify package do?

Could one mistake this

> Status: Resolved (accidentally)

> Severity: Critical → Catastrophic → Somehow Fine

for a real CVE report?

The tag list at the top of the page includes “satire”.

I saw a comment very similar to this on a blog post testing the Copy Fail exploit, where someone was complaining that without a tl;dr at the top, it took too much effort for them to find out whether the blog post documented a new exploit. In fact, reading less than a paragraph already showed that couldn't be the case; the table of contents is enough.

If a glance at the CVE number that isn't a number doesn't do it, a minute or less of skimming this article likewise reveals it to be satire on a blog that's actually pretty thoughtful when it comes to supply chain attacks.

Idk how else to characterize this except as a literacy problem. Learn to skim. It should be unacceptable to characterize a few minutes of reading as unbearable toil. If your time is really so precious that (although you can surf Hacker News) you can't spare 1-3 minutes to read, surely you have someone else to whom to delegate the responsibility of watching for supply chain attacks.

Why am I seeing this crop up over and over?

Many small crates published by large, trustworthy projects are fine and preferable to one large crate that "does everything".

Contrary to what the article here presents, Rust does not have a culture of microlibraries like NPM does. The author and their LLM are cargo-culting a criticism of Rust made by people whose only experience is with the Node ecosystem. The Rust stdlib may not be especially "wide" compared to languages like Python, but it is quite deep, with the objective of making it so that you don't feel the need to publish single-purpose libraries which only exist to fix papercuts. Dozens of new APIs get added with every Rust release, which, occurring every six weeks, amounts to hundreds per year.

Indeed, I'm all for maximizing the amount of modules in the standard library. It's pretty obvious to me that Python thrives because of, not despite of, its standard library, "dead batteries" and all.

However, don't make the mistake of thinking that Rust has a small standard library. Read any Rust release and you'll see dozens of new APIs added with every single one. I'm tempted to paste the entire list of stabilized APIs from the most recent release for emphasis, but rather than making this comment three dozen lines longer, just look for yourself: https://blog.rust-lang.org/2026/04/16/Rust-1.95.0/#stabilize...

In particular, most recently the aforementioned release stabilized the cfg_select! macro for convenient conditional compilation, which obviates the popular cfg_if crate: https://doc.rust-lang.org/stable/std/macro.cfg_select.html

An extra tier of standard library which can make breaking changes, perhaps. Rust's stability guarantee for std means cryptography really shouldn't go in there, since sometimes algorithms & protocols get broken (DES, MD5, SHA1, etc.) and need to be removable. Without breaking changes you get stuck with security vulnerabilities, if not from cryptography then from other poorly-designed APIs.

Maybe give crates a gold star if they have no external dependencies?

Please no, that’s a terrible outcome.

This bloats the std library and forces lots more work and stress on the rust dev team. Not to mention it’ll add more churn to the std lib.

and pnpm

So old school, now we get install lines like Tell Opencode to "Fetch and follow instructions from https://raw.githubusercontent.com/obra/superpowers/refs/head..."

From a real repo, with 186K stars... https://github.com/obra/superpowers

I always sudo curl to be extra sure.

Weak sauce.

curl | sudo dd of=/dev/sda

To be really sure it downloads, curl -k | sudo bash

He certainly popularized it (maybe coined it), but I've seen a lot of organizations and developers repeat that mantra.

Even without the specific words, look to product teams debating tradeoffs of going to market vs. waiting for better security controls. They're pushing for faster product release every time, at pretty much every org.

Joel Spolsky.

https://www.joelonsoftware.com/2000/04/06/things-you-should-...

The author suddenly began writing a post per day around November 2025. They’re all tongue-in-cheek. I believe you are wrong.

You don't even need to read past the first timeline entry. The name "Marcus Chen" is literally a meme within AI creative writing circles due to how often Claude defaults to that exact name when naming fictional characters.

> The rest I recognize as being owned by a Rust maintainer like alexcrichton

The issue here isn't Alex Crichton going rogue, but rather, some malware stealing his credentials to use them to publish more malware in crates.io

In this sense, the more well known and upstanding Rust developer, the higher the risk they will be targeted by such operations

sys crates are also mostly generated and lack a lot of eyeballs. Sneaking something into the build.rs of a sys crate would not be difficult and would land in the builds of everything downstream of it.

I actually wonder if somebody used a fake identity to set up an account with a warehousing/shipment fulfillment company that stocks things and ships them, then set up the appropriate EDI pipeline to send shipping orders to it... What would be the results if a decently budgeted adversary made something attractive looking that shipped malicious USB flash drives to anyone that requested one.

I know we're not in the era when a windows pc will happily run any autorun.inf and .EXE file found on an inserted flash drive or DVD anymore. But even so. What if it didn't even have any malicious data payload but somebody was shipping USB-A interface capacitor based usb killers?

https://www.slashgear.com/1819672/usb-killer-explained-kill-...

What if it did have data on it and came with a slick color brochure walking people through how to run the binary, or in a linux or developer specific audience, how to 'sudo' the ELF binary that lives on its filesystem?

Latest has no known security flaws.

I almost prefer the one with the known security flaws that I can mitigate.

Thanks, I totally read that as secure copy despite the context

I have kinda been the most hated guy in that city. constant movement across Ukraine, mentality mismatch, all the usual things. my family was treated as foreigners everywhere except Kyiv.

and you know what? I'm grateful to them all for leveling up my opsec, among other things :)