News for hackers. Stuff that matters.

A comment on Nx compromised: malware uses Claude code CLI to explore the filesystem. Parent comment

Re:Nx compromised: malware uses Claude code CLI to explore t... by cedws on Wednesday August 27, 2025 @10:23AM (#45040142)
Yes but it's the fact that cargo can pull a massive unreviewed dependency tree and then immediately execute code from those dependencies that's the problem. If you have a repo with a Makefile you have the opportunity to review it first at least.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by pharrington on Wednesday August 27, 2025 @11:01AM (#45040664)
You are allowed to read Cargo.toml.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by cedws on Wednesday August 27, 2025 @11:52AM (#45041347)
Cargo.toml does not contain the source code of dependencies nor transient dependencies.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by magackame on Wednesday August 27, 2025 @12:49PM (#45042044)
Welp, `cargo tree`, 100 nights and 100 coffees then it is
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by marshray on Wednesday August 27, 2025 @05:39PM (#45045623)
Yes!

I sometimes set up a script that runs several variations on 'cargo tree', as well as collects various stats on output binary sizes, lines of code, licenses, etc.

The output is written to a .txt file that gets checked-in. This allows me to easily observe the 'weight' of adding any new feature or dependency, and to keep an eye on the creep over time as the project evolves.

[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by johnisgood on Thursday August 28, 2025 @04:50AM (#45049924)
You will need something stronger than caffeine.
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by duped on Wednesday August 27, 2025 @12:20PM (#45041698)
Do you review the 10k+ lines of generated bash in ./configure, too?
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by cozzyd on Wednesday August 27, 2025 @09:16PM (#45047213)
./configure shouldn't be in your repo unless it's handwritten
[ Parent | on HN ]
Re:Nx compromised: malware uses Claude code CLI to explore t... by johnisgood on Thursday August 28, 2025 @04:52AM (#45049931)
Pretty much. It is called "autotools" for a reason.

Theoretically you should be able to generate the configuration scripts through "autoconf" (or autoreconf), or generate Makefile.in for configure from Makefile.am using "automake", etc.

[ Parent | on HN ]