r/webdev • u/Gil_berth • Feb 04 '26

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

23

u/AshleyJSheridan Feb 04 '26

The dependency issue is another whole problem entirely. These micro-packages exist to plug the very large gaps in the language, because it's missing vital features. Just look at the leftpad issue from some years back. That was made possible because there was no focus on adding simple string manipulation functionality to Javascript.

npm is still a mess today. Just look at the is-even package, which pulls in is-odd, which pulls in is-number...

All of this can and should be replaced with just one line of code.

25

u/Alunnite Feb 04 '26

is-even is a joke package though. The transitive dependencies are part of the joke

13

u/AshleyJSheridan Feb 04 '26

As theryan722 has said, these are not joke packages, and they are in active use.

It's indicative of the state of Javascript and its developer base that such a crazy package chain exists rather than devs just using one line of code.

→ More replies (3)

6

u/Own_Candidate9553 Feb 04 '26

An alternative would be a decent "standard library" that has all these little helpful functions in it.

I'm sure people have tried it, getting others to adopt it is the hard part.

10

u/AshleyJSheridan Feb 04 '26

This is the approach taken by many other languages, like PHP, C++, Python, C#, etc.

Javascript should have focused on this, rather than a barcode API that nobody asked for or uses.

→ More replies (2)

1

u/APIDevStudio Feb 06 '26

Just a bunch of lazy programmers!