3 ms·
> malicious-NPM-package-of-the-week This is going to get worse and worse. I recently noticed AI harness (e.g. OpenCode) downloading random npm packages in the
by ffemac 4mo ago
> malicious-NPM-package-of-the-week
This is going to get worse and worse. I recently noticed AI harness (e.g. OpenCode) downloading random npm packages in the background and litter them everywhere in a few place in ~ and in your project dir, all without telling/asking you.
What's worse is that people don't seem to care even the devs.
- himata4113 4mo agoYou typically don't want to run opencode outside a sandbox anyway.
- ffemac 4mo agoTrue, but security breach inside a sandbox/container can cause serious damage too(stealing your code/data/keys, spreading via your code/release etc). And containers aren't for security anyway(e.g. Copy Fail breaching to host https://xint.io/blog/copy-fail-pod-to-host https://xint.io/blog/copy-fail-pod-to-host)
- himata4113 4mo agoIt's rare that both of those align and it is very unlikely that both are used at once. Most of the exploits (if not all) just install rce, rat and/or steal env.