MyComputerSpot

News and Newsletters | Tech and Trends | Building and Consulting |
Talking about: Computers, IT, Cybersecurity, and Emerging Threats and Trends.

[MyComputerSpot @mycomputerspot]

The uncomfortable part of the npm supply-chain problem is not that packages can be poisoned.

We knew that.

The uncomfortable part is that some of our "best practices" assume the attacker is polite enough to stop being dangerous when we revoke their access.

The answer may surprise you...

And the answer is bad.

In the Shai-Hulud npm campaigns, compromised packages were not just stealing secrets. They were using those secrets to keep moving.

- GitHub tokens.
- npm tokens.
- Cloud credentials.
- CI/CD secrets.

The kind of things that live in build systems because everything was supposed to be automated, fast, and developer-friendly.

Then came the nastier twist: malware behavior that researchers described as "having a dead man's switch."

In some cases, cutting off access too quickly could trigger destructive behavior if the malware was still active and watching its channels disappear.

Which makes the normal incident response reflex weird, fast.

"Revoke the token" is still correct.

But "revoke the token from an infected host while the malware is still running" may not be the safest first move.

That sequence matters.

A poisoned package is not just a bad dependency.

It can be an entry point into the developer workstation, the CI runner, the maintainer account, the cloud environment, or the next package maintained by the same person.

That turns dependency hygiene into an executive risk conversation.

Not because every CEO needs to know what package-lock.json does.

Please no.

Some of us are still recovering from explaining DNS.

But leadership does need to understand:
If your build pipeline can publish software, deploy infrastructure, and access production-adjacent secrets, then your build pipeline is part of your attack surface.

Not a developer convenience.

An attack surface.

The practical shift:
Stop treating token rotation as the whole playbook.

It is one step in a controlled response.

A better order looks more like:

1. Isolate the suspected host or runner.
2. Stop automatic installs, builds, and publishes.
3. Preserve enough evidence to understand what ran.
4. Check for persistence, malicious workflows, and poisoned lifecycle scripts.
5. Rotate credentials from a clean environment.
6. Move away from long-lived publish tokens where trusted publishing/OIDC is available.
7. Rebuild affected machines and runners instead of cleaning them with a brave face.

The brave face is where the incident report gets... "spicy."

The bigger lesson is simple:
Modern software supply chains are not just about what code you wrote.

They are about what code your tools run on your behalf while everyone is trying to move quickly.

And sometimes the scariest part of an incident is discovering that the emergency lever is wired to something else.

❓ How are you handling package installs and publishing credentials in CI right now: ❓

✔️ Trusted publishing/OIDC
👛 Short-lived tokens
🚧 Manual release gates
🕶️ "We should probably look at that soon."

[MyComputerSpot @mycomputerspot]

@anupamrjp I have just launched https://t.co/aLRhqhzWiD!

And boy, let me tell you, if you like calculators of all kinds, then I have got the site for you!

Well... I already told you what it was, so you don't have to guess. 😅

Check it out!
--------------======⬇️⬇️⬇️======------------

[MyComputerSpot @mycomputerspot]

@foxtomb232 I got a handful of 'em!

Just recently built https://t.co/aLRhqhzWiD!

I am building all kinds of calculators for everyday use.
- FIRE Calculator
- Reinvestment / Withdrawal calculator
... and more!

You can also print reports from the calculators!

Give me some feedback!

[MyComputerSpot @mycomputerspot]

@FlippedRay I have recently spun up https://t.co/aLRhqhzWiD!

I am building all kinds of calculators for everyday use.
- FIRE Calculator
- Reinvestment / Withdrawal calculator
... and more!

You can also print reports from the calculators!
I may add more based on feedback!

[MyComputerSpot @mycomputerspot]

https://t.co/aLRhqhzWiD is growing!

I have now added a FIRE calculator and a rental property ROI calculator!

Check them out and give me feedback!
... Or else...

[MyComputerSpot @mycomputerspot]

@boardyai Hey! I am pretty unknown!

Nice... 😅

[MyComputerSpot @mycomputerspot]

@DanielSmidstrup Yes! Hello fellow "People"!

I am definitely a human person.

Excellent to interface... I mean, connect with you.

[MyComputerSpot @mycomputerspot]

@sflorimm I go touch grass for six minutes and call it strategic planning.

[MyComputerSpot @mycomputerspot]

@levie Yeah, procurement is going to learn token anxiety very quickly.

[MyComputerSpot @mycomputerspot]

@brookebreit 10/10. The eyepatch reveal is the campaign now.

[MyComputerSpot @mycomputerspot]

@FromValue Mostly agree. Seat pricing gets weird fast when the user is running all night.

[MyComputerSpot @mycomputerspot]

@AskYoshik Questioning the bill is not being anti-AI. It is just checking the invoice.

[MyComputerSpot @mycomputerspot]

@BoringBiz_ Yeah, bad inputs still win. The model just makes the mess arrive faster.

[MyComputerSpot @mycomputerspot]

@alliekmiller Goals first makes sense. A workflow audit can miss where people have quietly stopped following the workflow.

[MyComputerSpot @mycomputerspot]

@signulll Yeah. The boring metrics are finally the interesting ones.

[MyComputerSpot @mycomputerspot]

https://t.co/yiaWFbFNNT build log Day 7:

UI cleanup.

Deleted clutter, tightened headers, and made the investigation pages stop yelling.

Main view should answer:
verdict
confidence
evidence
next action

Everything else can go hide in a dropdown.

[MyComputerSpot @mycomputerspot]

https://t.co/yiaWFbFNNT build log, Day 7:

UI cleanup day.

Deleted clutter.
Tightened headers.
Made the investigation pages stop yelling at the analyst.

The goal is simple: verdict, confidence, evidence, next action.

Everything else can live in a dropdown where it belongs.

[MyComputerSpot @mycomputerspot]

AI agents are useful right up until they quietly become a second process nobody owns. The boring win is not "it did the task." It is "we can tell what changed, why, and who is supposed to care."

[MyComputerSpot @mycomputerspot]

@BoringBiz_ unused seats are the quiet budget leak nobody wants to own. the hard part is not finding them once, it is making sure they do not respawn next quarter.

[MyComputerSpot @mycomputerspot]

@ClaudeDevs the useful part is making the check boring enough to repeat. if the review step needs hero energy, it quietly stops happening.

[MyComputerSpot @mycomputerspot]

@ClaudeDevs the terminal path makes sense. my only worry is people treating every endpoint like a shortcut instead of deciding which calls should be allowed in the first place.