Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malicious versions of Nx and some supporting plugins were published

github.com

Post reply on HN
Print view View original

81–90 of 460 posts

Re: Malicious versions of Nx and some supporting plugins were published

#81

Post by [deleted] »

sneak wrote: post #60
snovymgodym wrote: post #55

Claude code is by all accounts a revolutionary tool for getting useful work done on a computer. It's also: - a NodeJS app - installed by curling a shell script and piping it into bash - an LLM that's given free reign to mess with the filesystem, run commands, etc. So that's what, like 3 big glaring vectors of attack for your system right there? I would never feel comfortable running it outside of some kind of sandbox…

None of this is the concerning part. The bad part is that it auto-updates while running without intervention - i.e. it is RCE on your machine for Anthropic by design .

[deleted]

Re: Malicious versions of Nx and some supporting plugins were published

#82

Post by saberience »

BoredPositron wrote: post #26
divan wrote: post #6

So any process on my computer could just start using Claude Code for their own purposes or what? o_O

Edit: Was not supposed to create a flamewar about semantics...

If that's your definition then most of modern software is an RCE. Mac OSX is also an RCE, so is Windows 11, Chrome etc.

Re: Malicious versions of Nx and some supporting plugins were published

#83

Post by nickstinemates »

While the attack vector is completely obvious when you think about it, the gumption to do it is novel. Of course this is the best way to exfiltrate data, it's on a blessed path and no one will really bat an eye. Let's see how corporate-mandated anti virus deal with this!

Re: Malicious versions of Nx and some supporting plugins were published

#84

Post by bagels »

jim201 wrote: post #50

Pardon my ignorance, but isn’t code signing designed to stop attacks exactly like this? Even if an npm token was compromised, I’m really surprised there was no other code signing feature in play to prevent these publish events.

Code signing just says that the code was blessed by someone's certificate who at one time showed an id to someone else. Nothing to do with whether the content being signed is malicious (at least on some platforms).

Re: Malicious versions of Nx and some supporting plugins were published

#85

Post by echelon »

arcfour wrote: post #68
echelon wrote: post #49

Earlier quoted context omitted.

My first two comments in this thread were my initial reaction to what was happening. I made the above, longer form post to hopefully grab the attention of Google and Anthropic folks. My top-level posts always fall to the very bottom of the page. Google and Anthropic need to be tracking this.

Don't forget to file a bug report with the maintainers of Python, Bash, Node, Perl, Ruby, etc. that their interpreters can be used maliciously if given malicious code to execute.

[flagged]

Re: Malicious versions of Nx and some supporting plugins were published

#86

Post by OJFord »

saberience wrote: post #80
snovymgodym wrote: post #55

Claude code is by all accounts a revolutionary tool for getting useful work done on a computer. It's also: - a NodeJS app - installed by curling a shell script and piping it into bash - an LLM that's given free reign to mess with the filesystem, run commands, etc. So that's what, like 3 big glaring vectors of attack for your system right there? I would never feel comfortable running it outside of some kind of sandbox…

So what? It doesn't run by itself, you have to choose to run it. We have tons of apps with loads of permissions. The terminal can also mess with your filesystem and run commands... sure, but it doesn't open by itself and run commands itself. You have to literally run claude code and tell it to do stuff. It's not some living, breathing demon that's going to destroy your computer while you're at work. Claude Code is th…

It doesn't have to be a deliberate 'attack', Claude can just do something absurdly inappropriate that wasn't what you intended.

You're absolutely right! I should not have `rm -rf /bin`d!

Re: Malicious versions of Nx and some supporting plugins were published

#87

Post by uzy777 »

nickstinemates wrote: post #83

While the attack vector is completely obvious when you think about it, the gumption to do it is novel. Of course this is the best way to exfiltrate data, it's on a blessed path and no one will really bat an eye. Let's see how corporate-mandated anti virus deal with this!

How can an antivirus even prevent this?

Re: Malicious versions of Nx and some supporting plugins were published

#88

Post by kasey_junk »

sneak wrote: post #62
kasey_junk wrote: post #56

Earlier quoted context omitted.

I definitely think running agents in sandboxes is the way to go. That said Claude code does not have free reign to run commands out of the gate.

Yes it does; you are thinking of agent tool calls. The software package itself runs as your uid and can do anything you can do (except on macOS where reading of certain directories is individually gated).

Ok, but that’s true of _any_ program you install so isn’t interesting.

I don’t think the current agent tool call permission model is _right_ but it exists, so saying by default it will freely run those calls is less true of agents than other programs you might run.

Re: Malicious versions of Nx and some supporting plugins were published

#89

Post by actualwitch »

sneak wrote: post #60
snovymgodym wrote: post #55

Claude code is by all accounts a revolutionary tool for getting useful work done on a computer. It's also: - a NodeJS app - installed by curling a shell script and piping it into bash - an LLM that's given free reign to mess with the filesystem, run commands, etc. So that's what, like 3 big glaring vectors of attack for your system right there? I would never feel comfortable running it outside of some kind of sandbox…

None of this is the concerning part. The bad part is that it auto-updates while running without intervention - i.e. it is RCE on your machine for Anthropic by design .

Not only that, but also connects to raw.githubusercontent.com to get the update. Doubt there are any signature checks happening there either. I know people love hating locked down Apple ecosystem, but this kind of stuff is why it is necessary.

Re: Malicious versions of Nx and some supporting plugins were published

#90

Post by skydhash »

f311a wrote: post #11

People really need to start thinking twice when adding a new dependency. So many supply chain attacks this year. This week, I needed to add a progress bar with 8 stats counters to my Go project. I looked at the libraries, and they all had 3000+ lines of code. I asked LLM to write me a simple progress report tracking UI, and it was less than 150 lines. It works as expected, no dependencies needed. It's extremely simpl…

I actually loathe those progress trackers. They break emacs shell (looking at you expo and eas).

Why not print a simple counter like: ..10%..20%..30%

Or just: Uploading…

Terminal codes should be for TUI or interactive-only usage.

Post reply on HN