NPM packages from Red Hat have been compromised

Re:NPM packages from Red Hat have been compromised by rixed on Monday June 01, 2026 @11:11AM (#48357904)

One hour ago, while looking casually at a package.json, I saw this and was horrified:

  rm -rf pkg/snippets & rmdir pkg\\snippets /s /q & wasm-pack build --target bundler && node prepare-web.js

Looked like a strange mix of unix shell and msdos batch that would, on my box, try to rmdir "/s" and "/q". I asked Claude about this, and he replied something like "Yes that's a standard and clever hack to delete a directory that works both on linux and windows!".

Poor Claude has been trained on so much awful human code that it required several prompts for it to admit that there was indeed a problem.

The industry is the process by which convenient crap like this gets standardized.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by tremon on Monday June 01, 2026 @11:50AM (#48358497)

To meekly defend the indefensible here: it's not like rmdir on Linux (I won't speak for all Unixen) can cause loss of data, since it only removes empty directories.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by MattSteelblade on Monday June 01, 2026 @12:11PM (#48358799)

In this case, the rm -rf before that does. The rmdir is the Windows command in this example and with /s /q, it will quietly delete everything.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by rixed on Monday June 01, 2026 @01:16PM (#48359754)

Yep, but that could still cause issues (those entries could be used as signals, or be mount points for currently unmounted partitions, etc). rmdir anything that start with "/" should be an absolute no-go.

To say nothing about running a sequence of shell commands without the -e option.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by lokar on Monday June 01, 2026 @11:20AM (#48358022)

Yikes. I would never approve a PR with that in it.

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by lionkor on Monday June 01, 2026 @12:10PM (#48358785)

Your agent might!

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by cozzyd on Monday June 01, 2026 @11:25AM (#48358110)

I hope the "standard" part is as much of a hallucination as "clever" is

[ Parent | on HN ]

Re:NPM packages from Red Hat have been compromised by PunchyHamster on Monday June 01, 2026 @11:24AM (#48358095)

> Poor Claude has been trained on so much awful human code that it required several prompts for it to admit that there was indeed a problem.

Claude probably birthed this abomination in the first place

[ Parent | on HN ]