←back to thread

Malicious versions of Nx and some supporting plugins were published

(github.com)
441 points longcat | 1 comments | 27 Aug 25 01:38 UTC | HN request time: 0s | source
Show context
grav ◴[27 Aug 25 13:08 UTC] No.45039159[source]▶
> Interestingly, the malware checks for the presence of Claude Code CLI or Gemini CLI on the system to offload much of the fingerprintable code to a prompt.

Can anyone explain this? Why is it an advantage?

replies(3): >>45039226 #>>45039286 #>>45039823 #
1. NitpickLawyer ◴[27 Aug 25 13:13 UTC] No.45039226[source]▶
Some AV / endpoint protection software could flag those files. Some corpo deep inspection software could flag those if downloaded / requested from the web.

The cc/geminicli were just an obfuscation method to basically run a find [...] > dump.txt

Oh, and static analysis tools might flag any code with find .env .wallet (whatever)... but they might not (yet) flag prompts :)