Episode: 75

The Read-the-Script Fallacy

This one starts with Matt eating his words from It’s time to let JavaScript go, but the admission is just the door in. What’s on the other side is a longer, harder look at security fatalism: why the entire software world runs on code nobody can fully check, why even careful people keep running install scripts they haven’t read, and why that behaviour is rational rather than reckless. Shai-Hulud, a supply-chain worm we’ve seen before, now spreading beyond JavaScript into other ecosystems in what Matt calls a zoonotic spillover, gives it all a nasty topicality, but the real question underneath is about trust, and where you can honestly draw the line.

We get into:

  • Why the new wave of attacks hijacks the AI coding assistants developers now leave running in the background, so the standard “turn off the risky auto-run behaviour” advice no longer saves you
  • How the newest variant hides its trigger in plain sight: the package itself looks clean, but installing it quietly reaches out, downloads a hidden payload, and runs it, all through a completely ordinary, legitimate-looking mechanism
  • Why “I just won’t build or run it on my own machine” doesn’t help, because the worm deliberately goes after the automated build servers instead
  • The read-the-script fallacy: why “just read the install script before you run it” is useless advice once you realise that script pulls in other scripts, which pull in others, until reading it all is humanly impossible
  • Why the .NET/NuGet world is more resistant but not immune, and how a single compromised popular package could still quietly steal secrets straight out of a running production app
  • The difference between trusting a source and trusting a specific thing, and why locking to an exact verified version beats a signature that only proves who published it (an account that could itself be compromised)
  • Why the tools we lean on to catch this can flag what they don’t recognise, but can’t see inside a sealed binary to tell you it’s malicious, and whether the only honest answer is to detonate suspect code in a sandbox and watch what it actually does
  • The uncomfortable truth that trusting open source “because a million eyes are on it” is both a dodge and the only rational thing any one person can actually do
  • And the reason for the “I was wrong”: why the modern browser has Matt cautiously believing there might be a way out after all

No neat bow, and no silver bullet; just an honest map of how we got here and where the fuzzy line might sit.

🍻 Tonight’s Drinks

Matt – A pint of Clone and Wood (his own homebrew — he felt he’d earned it)
Liam – Abstaining tonight, fighting something off

Any Likes 👍, Shares 📣, Subscriptions 🔔, and Love ❤️ go a long way to helping us keep doing this for fun.

Cheers! 🍻