Shai-Hulud returns to npm: keyv and flat-cache compromised, and cooldowns are your best defense

By Javi and Rafa · Café con Codely · Last duo edition before Javi's vacation

A new wave of the Shai-Hulud worm hit npm a few days ago. Attackers compromised the keyv and flat-cache package families. flat-cache alone has more than 500 million weekly downloads. Even if you do not declare these packages in your package.json, they can enter as a transitive dependency of another library.

The entry vector is the package manager's preinstall and postinstall scripts. The malicious script exports your credentials: npm, GitHub, AWS and Kubernetes tokens, and .env files. It is a worm attack: it uses the stolen npm token of another maintainer to publish infected versions and jump between dependencies.

First defense: the Dependabot cooldown. Security tools such as Aikido detect these packages in minutes, but they do not detect all of them. A cooldown of days puts new versions in quarantine until the ecosystem validates them. This week's news: the cooldown configuration for Docker Compose failed silently, and it is fixed since May 20. It does not support semver segregation yet, but the default value now works.

Second defense: use pnpm with policies that block provenance downgrades. Third: set a minimum release age in your .npmrc for manual updates. Codely dodged this one, and they say it without bravado: the next wave can hit anyone. Watch in the video.

Tech job market in Spain: 6,200 offers in July and 93% still do not publish the salary

Eusebio, a former Amazon employee, publishes a monthly study of the Spanish tech job market. July had 6,200 offers, and 5,300 are real positions: the rest are reposts. 93% do not publish the salary, although the European directive 2023/970 is in force since June 7. If a candidate asks before the first interview, the company must disclose the range by law. More than half of the offers are remote or hybrid, and 65% concentrate in Madrid and Barcelona.

Data engineering leads the demand with 14%. Filtered by seniority, backend and full stack tie as the most wanted roles. Frontend sinks: the full stack role absorbs it, and a frontend offer receives 102 applications on average. Average salaries: engineering leadership, 98,000 euros; backend, 43,000; full stack, 40,000. Python is the most repeated keyword, at 32%. Only 14% of the offers mention AI as a work tool. Watch in the video.

Next.js 16.3 ships next/root-params: goodbye to locale prop drilling

Next.js 16.3 is now public. It brings memory improvements in development and instant navigation: if a fetch blocks navigation, it forces you to fix it or to declare it as blocking explicitly.

The detail the café liked most: next/root-params. You can read root URL params, such as the locale, from any Server Component and without prop drilling. Libraries such as next-intl already adopted it and updated their documentation: they remove all the hacks they needed until now. The debate stays open: is it good to hide that prop drilling, or should the dependency be explicit like in a constructor? Watch in the video.

The utility of the week

Space Rabbit

It removes the slow animation when you switch Spaces on macOS: it sends a fake trackpad gesture to the system and the switch is instant. It brings Instant Space Switch and Instant App Switch, which moves you to each application's Space with no transition. It includes a counter with the hours of your life it saves. It passes every café check: it is open source and it is on GitHub.

github.com/tahul/space-rabbit

The chat weighs in

yeasturianin: In my harness I specify that it must answer in the language of my question, but "think" and document in English, which consumes fewer tokens. I leave it as an idea to try.

cristobalcontrerasrubio4695: The good part of n8n or something tidy is to have everything in one place, auditable. Instead of many lost scripts, you have it all visual.

eyluismi168: By the way, Raycast Beta also has instant switching between Spaces, in case you already have it.

The saying of the week

«Pon lo tuyo en concejo y unos dirán que es blanco y otros que es negro»

Spanish saying: show your work at the town council and some will call it white, others black. Every head gives a different verdict. The Russian variant won on stream: "How many heads? That many minds." Watch in the video.

More Codely

Dependabot: Tu repo al día de forma segura y automática

The short, to-the-point course that shields your dependencies against worms like Shai-Hulud: how to configure the cooldown in several package managers, from npm to Docker and GitHub Actions, and which security considerations apply to each environment.

The joke of the week: How do hackers escape the police? \police

All the news we covered

#CaféConCodely · @CodelyTV · Previous cafés: cdly.to/cafe

Share on Twitter Share on LinkedIn