Hermetic build environments contain supply chain worms
Hermetic build environments can contain "Shai-Hulud" supply chain worms—self-replicating malware that spreads through build systems. By isolating builds from network access and external dependencies, hermetic builds prevent worms from reaching package registries or infecting other systems.
Background
- "Shai-Hulud attacks" (named after the sandworms in Dune) are a class of supply-chain malware in which a malicious package infects other packages it touches during the build process — not just the final artifact, but everything built alongside it.
- A "hermetic build" is a build process that is sealed off from the network and from all non-declared dependencies. It cannot reach out to the internet, nor read files it didn't explicitly list, so even if a worm is present, it can't spread to sibling packages.
- Supply-chain worms have become a pressing concern in the open-source ecosystem: in 2024, the "xz utils backdoor" (CVE‑2024‑3094) showed how a single compromised dependency can embed malware into SSH, affecting millions of Linux machines. Flox (the company behind this article) sells a hermetic, reproducible build tool built on Nix, aimed at preventing exactly this class of attack.