2 ms·
The exploit is a postinstall hook, so CC users would be unaffected. Claude Code itself is most likely built with bun and not npm, so the CC developers would al
by chuckadams 7mo ago
The exploit is a postinstall hook, so CC users would be unaffected. Claude Code itself is most likely built with bun and not npm, so the CC developers would also be immune.
- JamesSwift 7mo agoWell, technically bun doesnt _prevent_ hooks. It just requires opting into them. And even that also includes a default set of pre-whitelisted packages. A much better system, but not perfect. And actually just looking this up, it appears claude-code itself was just added to that whitelist : D https://github.com/oven-sh/bun/commit/5c59842f78880a8b5d9c2eb99c8928fc2ec50a2d#diff-7e3eaf75f193213fd44b6999d829204afa092994d80807c890bb5b578d0ae95d https://github.com/oven-sh/bun/commit/5c59842f78880a8b5d9c2e...