https://lexical.dev/ is currently down as deployments have been paused in response to Shai-Hulud escalated NPM package compromise

[thatmichael85]

https://playground.lexical.dev/ is still available

You may go here https://lexical-ckgmby78y-fbopensource.vercel.app/ to visit yesterday's preview deployment

[thatmichael85]

Please refer to https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack for more information

[zurfyx]

https://discord.com/channels/953974421008293909/1036719107921412137/1443283784211501300

Hi folks,

We wanted to share an update on the site outage yesterday. This was a preventive measure for the newly reported NPM security incident (https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack). To play on the safe side, we stopped builds and deployments while we assessed the impact of the attack.

At this point, we are highly confident that Lexical has NOT been impacted by the breach. Both the developer experience (for those pulling the entire repo) and consumers (npm install lexical etc.) are safe.

We will continue to monitor NPM news until the alert is clear. In the meantime, we will pause stable (aka latest) releases and we will not accept PRs that introduce new dependencies or updated versions (including the playground). We may also ask developers to run further verification steps before we revert to the normal development flow.

To close it out, we appreciate your continued support. We've recently surpassed the 1.5m weekly downloads (3x from the start of the year). Thank you! -- the Lexical Core Team