Hacker News new | past | comments | ask | show | jobs | submit
rhdunn | on: Keyv and friends compromised in active Shai-Hulud supply chain attack
The what happened section mentions the addition of the `setup.mjs` and `Math_Symbol.js`, along with a change in `package.json` to add `"preinstall": "node setup.mjs"`, so presumably checking for any of those would be a good indication to check further.

For example:

    find . -type f | grep -P "/Math_Symbol\.js$"
yread | parent
Crucially, Math_Symbol.js that is almost 800KB, not the innocent 1KB one from regenerate-unicode-properties
somebudyelse | root | parent
when i was searching i got a heartattack when i saw Math_Symbol.js. Thankfully my agent was able to figure it out.