logoalt Hacker News

GeorgeOldfieldyesterday at 9:12 AM1 replyview on HN

it's fun but PLEASE watch out for malicious code/supply chain attacks from random vibe-coded .sh scripts:

downloads other scripts (peon.sh, uninstall.sh) and executes them or places them where they will be executed later

edits your ~/.bashrc and ~/.zshrc files to add aliases and tab completion

parses a remote JSON file to get filenames ($sfile) and then does: curl ... -o "$INSTALL_DIR/packs/$pack/sounds/$sfile"


Replies

JohnMakinyesterday at 4:45 PM

Lol, yea, the scripts are beyond sketchy. This is the new vector, a cool idea masking itself as "fun" (which it is actually fun). People not understanding or vibing may not understand what they're installing. Even if this author isn't malicious, you cannot assume that will always be the case.

show 2 replies