A stolen YubiKey and an AI-generated phishing link triggered a 73-hour supply chain cascade compromising an estimated 4.2 million developer machines, resolved accidentally by a cryptocurrency worm.
Key Takeaways
Root cause: left-justify maintainer (847M weekly downloads) lost hardware 2FA, then entered nmp credentials on a phishing site surfaced by a Google AI Overview.
Malware spread through vulpine-lz4 (Rust) -> snekpack (Python build tool, vendored for “memory safety”) to ~4.2M developers; payload included an SSH backdoor and reverse shell active only on Tuesdays.
cryptobro-9000, an unrelated crypto mining worm, accidentally patched the incident by running pip install --upgrade, upgrading snekpack to a clean release before any official fix landed.
Dependabot auto-merged the malicious PR after CI passed because the malware installed the volkswagen package to fake green CI.
The nmp registry permits password-only auth for packages under 10M weekly downloads; mandatory 2FA was already policy but did not prevent credential theft via phishing.
Hacker News Comment Review
Commenters agree the supply chain model itself is broken but resist removing package registries like crates.io or npm, viewing them as net positives worth hardening rather than abandoning.
Proposed mitigation: Rust Foundation-backed auditing of a curated set of core crates, analogous to how the Rust language itself is audited, paired with cultural pressure toward fewer, larger dependencies rather than micro-crate proliferation (tokio cited as a model).
