When a programmer runs the hacked version of NX, the malware drops the exploit into their GitHub and runs that code. The malware stole a lot of people’s login keys and, apparently, their crypto wallets.
Here’s the novel bit — the malware code doesn’t steal your logins or crypto directly. Instead, it sends a prompt to Cursor, Claude Code, or any other AI coding bot on your computer, and it tells them to steal your stuff.
There is a bit of schadenfreude in the article, but the NX-case makes a great cautionary tale.
How often do you read about somebody writing an RFC for the NPM CLI? This is a great write-up by Evan Hahn about an improvement he proposed and the process of evaluating such an RFC. Loved reading it!
Would love to know the source for a ChatGPT answer. Wondering what this means for Google and StackOverflow. Would be great if we could discuss further on these answers to improve our collective understanding... 🤔
