Malicious versions of Nx and some supporting plugins were published

This week, I needed to add a progress bar with 8 stats counters to my Go project. I looked at the libraries, and they all had 3000+ lines of code. I asked LLM to write me a simple progress report tracking UI, and it was less than 150 lines. It works as expected, no dependencies needed. It's extremely simple, and everyone can understand the code. It just clears the terminal output and redraws it every second. It is also thread-safe. Took me 25 minutes to integrate it and review the code.

If you don't need a complex stats counter, a simple progress bar is like 30 lines of code as well.

This is a way to go for me now when considering another dependency. We don't have the resources to audit every package update.

> What's novel about using LLMs for this work is the ability to offload much of the fingerprintable code to a prompt. This is impactful because it will be harder for tools that rely almost exclusively on Claude Code and other agentic AI / LLM CLI tools to detect malware.

But I don't buy it. First of all the prompt itself is still fingerprintable, and second it's not very difficult to evade fingerprinting anyway. Especially on Linux.

Assemble your teams and immediately do the following:

1. Issue a public statement that you are aware of this issue and are tracking it

2. Begin monitoring your analytics to see which customers are impacted and shut down their access

3. Reach out to impacted customers and let them know you'll be preparing a list of next steps for them.

4. Monitor for a wider blast radius or larger attack surface area

5. Notify internal teams of broader security efforts as a result of this

6. After this cools down, hold internal and public postmortems.

Do this now.

Edit: -4 and flagged. I give up.