Show Notes
Scott and Wes break down the “Mini Shai-Hulud” supply chain attack that compromised TanStack and other popular npm packages through a clever GitHub Actions cache poisoning exploit; a self-propagating worm that stole credentials and persisted through Claude Code hooks and VS Code tasks. They also cover how developers can protect themselves using pnpm’s security defaults, dev containers, and other practical defenses.
Show Notes
00:00 Welcome to Syntax!
00:25 Understanding the Shai-Hulud Worm
Post Mortem of Shai Hulud Attack
02:47 Mechanics of the Attack: GitHub Actions and Cache
How the attack happened
Who Was Involved in the Attack
Several npm latest releases are compromised
Socket.dev
Step Security
05:44 Brought to you by Sentry.io
06:09 Propagation and Impact of the Worm
09:30 Preventative Measures for Developers
Dead Man’s Switch
12:33 The Role of Package Managers in Security
Block Exotic Subdeps
18:39 Using Dev Containers
Why You Should Use Dev Containers
Scott Tolinski’s Security Review
20:57 Conclusion and Final Thoughts
Sentry has Skills!
Hit us up on Socials!
Syntax: X Instagram Tiktok LinkedIn Threads
Wes: X Instagram Tiktok LinkedIn Threads
Scott: X Instagram Tiktok LinkedIn Threads
Randy: X Instagram YouTube Threads
More from Syntax - Tasty Web Development Treats
Scott and Wes talk with Adam Jacob about software factories: what they actually are, why they’re unique to each team, and how to build trust in agent-generated code. They dig into Swamp Club, black box testing, domain driven design, adversarial review for accessibility, and whether unit tests still earn their keep.
Deno is shutting down and the team is heading to Cloudflare — Scott, Wes, and CJ break down what that means for the runtime, JSR, and workerd. Plus OpenCode 2.0 on durable objects, TanStack Start 1.0, SubQ Snap, Gemini 4 Argon, and Wes’s accidental $50 photo frame movement.
Someone just clean-room ported seven Adobe apps to Rust, and Wes is shocked at how good it is. Scott and Wes break down what it gets right, what’s still missing, and why copying software is easy but inventing what comes next is the hard part.
Scott, Wes, and CJ break down the latest Pi updates, including durable long-running agents, Codemode, and MCP support, then debate whether pull requests are dead in favor of issues. Plus Supabase picks up Turso, Screen Studio 4 drops, JavaScript Composites bring value-based equality, and a stack of new AI models from Google, OpenAI, Cloudflare, and more.
Scott and Wes answer listener questions about what replaced blogging, what to do while your AI agent works, and who should pay for token costs. They also cover keeping agents from going off the rails, getting your team excited about AI, and staying motivated when AI takes the fun out of coding.