# Isigaxa se-Dependabot sashicilela i-worm. Amaphakheji angama-22. Published: 2026-09-17 I-bot ivula isicelo sokudonsa. Umuntu uyasihlanganisa emizuzwini engama-24 kamuva. Emizuzwini engama-95 ngemuva kwalokho, i-worm isishicilele izinguqulo ezingama-110 eziyingozi zamaphakheji akhe angama-22 e-npm, ngaphansi kwegama lakhe, ngethoni eliyithole ku-CI yakhe. Canonical: https://thedailydiff.dev/zu/video/2026-09-17-dependabot-tanstack/ ## Lokho okuhlanganiswa yile vidiyo - I-bot, umuntu, i-worm - Kwenzeka kanjani, kungani i-npm ikuvumela, ubani okufanele asolwe - Ulwandlekho: i-cache enobuthi - 21:48 — isigaxa se-Dependabot - Kungani kusebenza ## Izahluko - 0:00 I-bot, umuntu, i-worm - 0:20 Kwenzeka kanjani, kungani i-npm ikuvumela, ubani okufanele asolwe - 0:30 Ulwandlekho: i-cache enobuthi - 1:15 21:48 — isigaxa se-Dependabot - 1:50 Kungani kusebenza - 2:20 git blame - 2:45 Ukwanda komonakalo - 3:00 Isinqumo ## Umbhalo obhaliwe ohunyushwe Kuhunyushwe kusuka ekulandiseni kokuqala kwesiNgisi. Umsindo namazwibela atholakalayo alawulwa yi-YouTube. ### I-bot, umuntu, i-worm 0:00 I-bot ivula isicelo sokudonsa; umuntu uyasihlanganisa emizuzwini engamashumi amabili nane kamuva. Emizuzwini engamashumi ayisishiyagalolunye nanhlanu ngemuva kwalokho, i-worm isishicilele izinguqulo eziyikhulu neshumi ze- amaphakheji, njengaye. I-postmortem ye-TanStack inezitembu zesikhathi zangaphambili, ezesondlozi elingezansi inazo zonke ezinye, kanti i-Hacker News iyinika amaphuzu ayinkulungwane neshumi nanye negama: Mini Shai-Hulud. Kwenzeka kanjani, kungani i-npm ikuvumela, ubani okufanele asolwe. ### Kwenzeka kanjani, kungani i-npm ikuvumela, ubani okufanele asolwe 0:21 Lokhu kunguThe Daily Diff, i-postmortem. Meyi 11, ekuseni. I-fork eqanjwe kabusha ivula isicelo sokudonsa ngokumelene ne-TanStack Router. Ivala kungakapheli ihora, kodwa i-workflow yokulinganisa isivele yasebenzisa ikhodi yayo futhi ### Ulwandlekho: i-cache enobuthi 0:33 yalondoloza i-cache enobuthi ngaphansi kokhiye i-workflow yokukhishwa ezoyisebenzisa. Neshumi nesishiyagalolunye namashumi amabili. Ukuhlanganiswa okusemthethweni kwenza ukukhishwa. I-cache ibuyela, i-binary ifunda imemori ye-runner, iphakamisa ithokheni yokushicilela, futhi ishicilele izinguqulo ezingamashumi ayisishiyagalombili nane kumaphakheji angamashumi amane nambili amaphakheji, anobufakazi obusemthethweni. Ukuhlolwa kuyehluleka. Iyashicilela noma kunjalo. Neshumi nesishiyagalolunye namashumi amane nesithupha, umcwaningi we-StepSecurity ufaka inkinga; ngo-9 UTC konke kuphelelwe yisikhathi futhi iseluleko sikhishiwe. 0:55 Ukuphelelwa yisikhathi akukho: i-npm iyala ukungashicileli lutho olunezibambelelo, ngakho kuhlala kufakiwe amahora. Amashumi amabili nanye namashumi amane nesishiyagalombili. Ephrojethini ye-aviation-data enezinkanyezi eziyisishiyagalolunye, I-Dependabot ivula isicelo sayo esivamile sokudonsa: yenyusa iqembu le-dev-dependencies, izibuyekezo eziyishumi nantathu. Ezimbili yizinguqulo ze-TanStack ezinobuthi. Amashumi amabili nambili neshumi nambili: kuhlanganisiwe. I-workflow yokushicilela yenza i-npm C-I ngethoni ku- ### 21:48 — isigaxa se-Dependabot 1:15 indawo; iscript sokulungisa siyifunda, kanti ngamashumi amabili nambili neshumi nesikhombisa i-worm iyashicilela njengaye. Izingxenye ezinhlanu zephakheji ngalinye ithokheni elifinyelela kulo, ngisho nephrojekthi endala eseceleni: ithokheni elilodwa elidala lakho konke. Izingxenye eziyikhulu neshumi emizuzwini engamashumi ayisishiyagalolunye nanhlanu. Uthola nge-imeyili, ngemuva kwamabili. Kungani kusebenza. Okokuqala: i-npm install yenza izikripthi zempilo zabantu abangabazi ngokuzenzakalelayo, nescript sokulungisa sokuncika ku-git sibalulekile. 1:39 Okwesibili: i-worm ifuna into eyodwa: ithokheni eshicilela ngaphandle kwesici sesibili. Bese ibuza irejista ukuthi yini enye leyo maintainer ephethe, futhi iphinde ishicilele konke ngaphakathi kwayo. Okwesithathu: akukho kulo chungechunge oluyimuntu. ### Kungani kusebenza 1:51 I-bot iyaphakamisa, i-pipeline iyifaka, kanti i-worm iyabuyisela: yayo amagatsha e-dead-drop abizwa nge-dependabot slash github-actions slash fremen. git blame. Imanuwali yokufaka ye-npm, amaphesenti angamashumi amahlanu nanhlanu: izikripthi zisebenza lapho kufakwa, okuphelelwe yisikhathi kuhlala kufakiwe, amathokheni okudlulisa isici esibili akhona. I-CI ye-TanStack, amashumi amabili nanhlanu: i-workflow engahloliwe yokudonsa lapho i-target isebenza ikhodi ye-fork enokufinyelela kokubhala kwi-cache. Umnikelo wokunyuka, amashumi nanhlanu: izibuyekezo eziyishumi nantathu zihlanganisiwe emizuzwini engamashumi amabili nane, ithokheni egumbini. 2:17 I-Dependabot, ezinhlanu: ithembekile kangangokuthi i-worm igqoka imifaniswano yayo. ### git blame 2:20 Ukwanda komonakalo: amaphakheji angamashumi amane nambili e-TanStack. Amashumi amabili nambili phansi, kusuka kuphrojekthi enezinkanyezi eziyisishiyagalolunye. Ngaphezu kwekhulu namashumi ayisithupha kuwo wonke ama-ecosystem uma i-worm ifinyelela eMistral. Yonke inguqulo engenhla yayinegunya elisebenzayo: yakhiwe yikhona okusemthethweni ipayiphi. Iqiniso. Isinqumo, i-postmortem: SHIP IT. Bobabili abaphathi bashicilela ama-postmortem anesitembu sesikhathi kungakapheli usuku; kungakapheli amathathu, ipayiphi elingezansi lifaka nge-ignore-scripts, lihlukanisa ukwakha ekushicileleni, futhi liwisa ithokheni elihlala isikhathi eside. ### Ukwanda komonakalo 2:47 Izenzakalo ze-npm azihambanga. NgoMsombuluko: ignore-scripts ekufakeni, nethokheni yokushicilela ngaphandle komsebenzi oyi- uyiwenza. Ngithumele isigameko ongasavunyelwe ukukhuluma ngaso, emazwanini, noma ku-thedailydiff.dev. Futhi lokho kuyi-diff yanamuhla. ### Isinqumo 3:00 NginguNiko wase-Axrisi. Hlanganisa ngokuzibophezela. ## Imithombo - [TanStack postmortem (Tanner Linsley, May 11, refined May 15)](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem) — tanstack.com - [TanStack "Hardening TanStack After the npm Compromise" (May 12)](https://tanstack.com/blog/incident-followup) — tanstack.com - [TanStack/router#7383 — the StepSecurity detection issue](https://github.com/TanStack/router/issues/7383) — github.com - [Downstream incident post, @squawk/\* (May 12)](https://github.com/neilcochran/squawk/discussions/251) — github.com - [Downstream hardening post (May 14)](https://github.com/neilcochran/squawk/discussions/264) — github.com - [The Dependabot PR #246 (opened 21:48 UTC, merged 22:12)](https://github.com/neilcochran/squawk/pull/246) — github.com - [@tan\_stack advisory post, 21:19 UTC](https://x.com/tan_stack/status/2053948103766716630) — x.com - [StepSecurity — worm internals, bypass\_2fa search, Dependabot-style branch names](https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem) — www.stepsecurity.io - [Socket](https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack) — socket.dev - [Aikido — "over 160 packages, including Mistral"](https://www.aikido.dev/blog/mini-shai-hulud-is-back-tanstack-compromised) — www.aikido.dev - [Hacker News (1,097 points)](https://news.ycombinator.com/item?id=48100706) — news.ycombinator.com