News for hackers. Stuff that matters.

A comment on Nx compromised: malware uses Claude code CLI to explore the filesystem. Parent comment

Re:Nx compromised: malware uses Claude code CLI to explore t... by exDM69 on Wednesday August 27, 2025 @10:12AM (#45040017)
The same applies to any Makefile, the Python script invoked by CMake or pretty much any other scriptable build system. They are all untrusted scripts you download from the internet and run on your computer. Rust build.rs is not really special in that regard.

Maybe go build doesn't allow this but most other language ecosystems share the same weakness.

[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by pdw on Wednesday August 27, 2025 @11:09AM (#45040796)
Right, people forget that the xz-utils backdoor happened to a very traditional no-dependencies C project.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by theteapot on Wednesday August 27, 2025 @02:57PM (#45043570)
xz-utils has a ton of build dependencies. The backdoor implant exploited a flaw in an m4 macro build dep.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by cedws on Wednesday August 27, 2025 @10:23AM (#45040142)
Yes but it's the fact that cargo can pull a massive unreviewed dependency tree and then immediately execute code from those dependencies that's the problem. If you have a repo with a Makefile you have the opportunity to review it first at least.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by pharrington on Wednesday August 27, 2025 @11:01AM (#45040664)
You are allowed to read Cargo.toml.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by cedws on Wednesday August 27, 2025 @11:52AM (#45041347)
Cargo.toml does not contain the source code of dependencies nor transient dependencies.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by magackame on Wednesday August 27, 2025 @12:49PM (#45042044)
Welp, `cargo tree`, 100 nights and 100 coffees then it is
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by marshray on Wednesday August 27, 2025 @05:39PM (#45045623)
Yes!

I sometimes set up a script that runs several variations on 'cargo tree', as well as collects various stats on output binary sizes, lines of code, licenses, etc.

The output is written to a .txt file that gets checked-in. This allows me to easily observe the 'weight' of adding any new feature or dependency, and to keep an eye on the creep over time as the project evolves.

[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by johnisgood on Thursday August 28, 2025 @04:50AM (#45049924)
You will need something stronger than caffeine.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by duped on Wednesday August 27, 2025 @12:20PM (#45041698)
Do you review the 10k+ lines of generated bash in ./configure, too?
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by cozzyd on Wednesday August 27, 2025 @09:16PM (#45047213)
./configure shouldn't be in your repo unless it's handwritten
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by johnisgood on Thursday August 28, 2025 @04:52AM (#45049931)
Pretty much. It is called "autotools" for a reason.

Theoretically you should be able to generate the configuration scripts through "autoconf" (or autoreconf), or generate Makefile.in for configure from Makefile.am using "automake", etc.

[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by Bridged7756 on Wednesday August 27, 2025 @10:24AM (#45040167)
In JavaScript just the npm install can fuck things up. Pre-install scripts can run malicious code.
[ Parent | on HN ]