> The scary part? This attack vector is perfect for developers. We download and run code all day long. GitHub repos, npm packages, coding challenges. Most of us don't sandbox every single thing.
Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your real project's dependencies also don't have subtle malware in them? Have you looked at all of them? Do you regularly audit them after you update? Do you know what other SDKs they are using? Do you know the full list of endpoints they hit?
How long do we have until the first serious AI coding agent poisoning attack, where someone finds a way to trick coding assistants into inserting malware while a vibe-coder who doesn't review the code is oblivious?
Embedded into this story about being attacked is (hopefully) a serious lesson for all programmers (not just OP) about pulling down random dependencies/code and just yolo'ing them into their own codebases. How do you know your real project's dependencies also don't have subtle malware in them? Have you looked at all of them? Do you regularly audit them after you update? Do you know what other SDKs they are using? Do you know the full list of endpoints they hit?
How long do we have until the first serious AI coding agent poisoning attack, where someone finds a way to trick coding assistants into inserting malware while a vibe-coder who doesn't review the code is oblivious?