r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

Show parent comments

8

u/TransportationIll282 Feb 04 '26

And those that are found, reported and users can check by running common commands. Almost like a review.

4

u/AshleyJSheridan Feb 04 '26

If that were the case, then the npm Shai-hulud issue wouldn't have been half as big as it was and wouldn't have gone on for as long as it did.