Hackers' Pub

Syntax	Description	Examples
`"` keyword `"`	Finds the string within quotes, including spaces. Case-insensitive. (Escape quotes inside with `\"`)	`"Hackers' Pub"`
`from:` handle	Finds content written by the specified user.	`from:hongminhee` `from:hongminhee@hollo.social`
`lang:` ISO 639-1	Finds content written in the specified language.	`lang:en`
`#` tag	Finds content with the specified tag. Case-insensitive.	`#HackersPub`
condition condition	Finds content that satisfies both conditions on either side of the space (logical AND).	`"Hackers' Pub" lang:en`
condition `OR` condition	Finds content that satisfies at least one of the conditions on either side of the OR operator (logical OR).	`#HackersPub OR "Hackers' Pub" lang:en`
`(` condition `)`	Combines the operators within the parentheses first.	`(#HackersPub OR "Hackers' Pub" OR "Hackers Pub") lang:en`

Jan Lehnardt @janl@narrativ.es

11/25/2025, 10:21:28 AM

Public

In all seriousness, what do we do now? Has this been stopped? Is it safe to start scanning our deps and know we find everything? Do we have to assume running `npm install` is extremely dangerous right now? What is npm doing?

I’ve advised my company to pause JavaScript development for the time being, and that surely can’t be it?
https://narrativ.es/@janl/115606622055750279

Jan Lehnardt :couchdb: (@janl@narrativ.es)

’No Way to Prevent This‘ Says Only* Package Manager Where This Regularly Happens. *I know. https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24

narrativ.es · narrativ.es

Anton 🇺🇦🇪🇺 @atjn@mastodon.online

11/25/2025, 11:05:22 AM

Public

@janlJan Lehnardt We just scan all projects for a package-lock.json file and check that it has not been updated since two days ago. That ensures you can't install infected versions. I think there is also work underway to scan all machines for user-installed packages, which also just scans for local package-lock files.

If you have a fediverse account, you can quote this note from your own instance. Search https://mastodon.online/users/atjn/statuses/115610007775964957 on your instance and quote it. (Note that quoting is not supported in Mastodon.)