Nx compromised: malware uses Claude code CLI to explore the filesystem

@dang Even though the blogpost has some helpful flavor, this GH issue seems much more direct and giving much more straightforward guidance for resolving the issue. Is it possible to change the link?

Credit to otterly and Hilift for finding some other better coverage than this semgrep page as well:

* https://news.ycombinator.com/item?id=45040126

* https://news.ycombinator.com/item?id=45040507

I do not like these coverages. They always write about VSCode Extension which has basically nothing todo with the bug.

It only did run affected programs of course but it's so stupid to even talk about vscode in that case. if you used the affected nx versions you are affected no matter if you used vscode,webstorm, whatever ide of your liking. if you used a not affected nx version nothing happend no matter which vscode version you used.

Hi! Author here who added the VSCode stat :)

I thought it was useful to include because:

* it can inform triage, if you use the extension you're more likely to be impacted * because it was VSCode, Workplace Trust actually partially mitigated this in at least 38 cases

(We detached this subthread from https://news.ycombinator.com/item?id=45038993.)

I found the first submission on the story (https://news.ycombinator.com/item?id=45034496), which used a github url, and merged the thread into it - more explanation at https://news.ycombinator.com/item?id=45042727.

The vocoder extension does not contain any affected packages, it‘s just misleading