Nx compromised: malware uses Claude code CLI to explore the filesystem

Re:Nx compromised: malware uses Claude code CLI to explore t... by autoexec on Wednesday August 27, 2025 @01:39PM (#45042600)

Software that automatically phoned home to check if an update is available used to be considered spyware if there wasn't a prompt at installation asking if you wanted that. The attitude was "Why should some company get my IP address and a timestamp telling them when/how often I'm online and using their software?" Some people thought that was paranoid.

We gave them an inch out of fear ("You'd better update constantly and immediately in case our shitty software has a bug that's made you vulnerable!") and today they've basically decided they can do whatever the fuck they want on our devices while also openly admitting to tracking our IPs and when/how often we use their software along with exactly what we're using it for, the hardware we're using, and countless other metrics.

Honestly, we weren't paranoid enough.

[ Parent | on HN ]

Re:Nx compromised: malware uses Claude code CLI to explore t... by marshray on Wednesday August 27, 2025 @06:04PM (#45045903)

From the perspective of the software vendor, it may be a semi-regular occurrence that they learn that users are being actively harmed by a software vulnerability exploited in-the-wild. So that's an argument that developers have a moral obligation to maintain the ability to push updates their users without delay.

Waiting for the user to click "Check for updates..." is effectively pushing this responsibility onto the users, the vast majority of whom lack the information and expertise needed to make an informed choice about the risk.

[ Parent | on HN ]

Re:Nx compromised: malware uses Claude code CLI to explore t... by CGamesPlay on Wednesday August 27, 2025 @08:54PM (#45047072)

We're talking about Claude Code, the frontend to the online, hosted LLM inference suite, right? The auto-updater isn't where they get their usage metrics.

[ Parent | on HN ]