forloop

cargo install safeinstall before you install something unsafe

[forloop @forloopcodes]

stop using curl | sh to download *any* installer you find on the internet, stop using npm to download global dependencies

this guy just built `safe`, a utility that inspects remote installer scripts before executing them, (all of this for just one star on github)

it downloads the artifact, runs static analysis, checks against vulnerability databases and reputation sources, then decides whether it's safe to run

here's an example showing Safe warning the user about the openclaw's npm install script:

github: https://t.co/6NfKNLgumo

[forloop @forloopcodes]

@prabhatlabs meditation app @zen_browser

[forloop @forloopcodes]

this is all i have on my taskbar rn lmao

[forloop @forloopcodes]

@SyntaxError2505 another zen user found + cs peak

[forloop @forloopcodes]

@SyntaxError2505 @_nitin787 atp jus use chromeos 😭😭😭😭

[forloop @forloopcodes]

@SyntaxError2505 @_nitin787 FAHHHHH

[forloop @forloopcodes]

@valigo fixed it already

https://t.co/4QEM0DqfNC

[forloop @forloopcodes]

stop using curl | sh to download *any* installer you find on the internet, stop using npm to download global dependencies

this guy just built `safe`, a utility that inspects remote installer scripts before executing them, (all of this for just one star on github)

it downloads the artifact, runs static analysis, checks against vulnerability databases and reputation sources, then decides whether it's safe to run

here's an example showing Safe warning the user about the openclaw's npm install script:

github: https://t.co/6NfKNLgumo

[forloop @forloopcodes]

if ai suddenly disappears tomorrow, will you still be able to talk to your girlfriend?

[forloop @forloopcodes]

@shank_03 i was about to press n anyways

[forloop @forloopcodes]

stop using curl | sh to download *any* installer you find on the internet, stop using npm to download global dependencies

this guy just built `safe`, a utility that inspects remote installer scripts before executing them, (all of this for just one star on github)

it downloads the artifact, runs static analysis, checks against vulnerability databases and reputation sources, then decides whether it's safe to run

here's an example showing Safe warning the user about the openclaw's npm install script:

github: https://t.co/6NfKNLgumo

[forloop @forloopcodes]

@kvmcat its my fave

[forloop @forloopcodes]

lmfaooooo

[BnSnK @BunSnack]

rsync 3.4.3 broke incremental backups. Users traced it to AI commits by tridge and claude. GitHub issue "Please Do Not Vibe Fuck Up This Software" hit #1 on HN with 431 points. 21k lines of churn by a solo maintainer with no code review.

[forloop @forloopcodes]

Now Pulling Malware

[BnSnK @BunSnack]

IronWorm and new Miasma worm variant hit npm — Rust-based info stealer deploys eBPF rootkit, routes C2 over Tor, and self-propagates via stolen credentials. Over 50 packages poisoned in coordinated supply chain attack.

https://t.co/SQS2awSyXu

[forloop @forloopcodes]

@peach2k2 https://t.co/Y95wH1DQds

[forloop @forloopcodes]

https://t.co/aPs9676KBK

[forloop @forloopcodes]

@peach2k2 you gotta read my article

[forloop @forloopcodes]

@xcopydotexe all of this just to get one (1) star on gh

[forloop @forloopcodes]

@radmadvlad it makes u curl

[forloop @forloopcodes]

@colemurray 😭 how could it be

[forloop @forloopcodes]

@alxfazio freaky fazio trvke

[forloop @forloopcodes]

@_wearr_ ita called iosevka

[forloop @forloopcodes]

@avrldotdev lmao

[forloop @forloopcodes]

@avrldotdev thanks!!

[forloop @forloopcodes]

@powerm1nt free models yes