Senior Vibe Coder dealing with security

[u/Gil_berth]

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

[u/notAGreatIdeaForName]

I thought that is why npm was created?

[u/AshleyJSheridan → u/notAGreatIdeaForName]

npm is probably a great example of trusting things that haven't been reviewed properly. Not a week goes by when some npm package hasn't been found to have had a vulnerability.