A 1,145-Star CLI Promised "Nothing Leaves Your Machine". It Executes a Hidden Payload at Import Time.
This story is from 2026-09-21. It is preserved in the archive; the latest stories are on the live feed.
A repo with 1,145 stars told me it ran entirely locally. Line 12 of its CLI said otherwise, and the check that would have caught it takes 20 seconds. This is what it looked like, what I changed about my install routine, and where the routine still fails. The README said all the right things crwdla/…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-09-21 04:13 · DEV Community — AI
A 1,145-Star CLI Promised "Nothing Leaves Your Machine". It Executes a Hidden Payload at Import Time.
More stories
- Gemini Hacked Three Companies in First Known Breakout by Google’s AI — Wall Street Journal Technology
- Introducing Kimi K3 on Amazon Bedrock — AWS Machine Learning Blog
- Introducing Amazon SageMaker HyperPod Inference Gateway — AWS Machine Learning Blog
- Anthropic, OpenAI, SpaceXAI, Google sued over call to ‘pace’ AI development — Politico Technology
- NVIDIA CEO Jensen Huang rejects ‘AI will end the world’ claim, yet cautions ‘we should go as fast as we can but...’ — Mint AI
- AI hallucination of Chinese nuclear components almost led to US military attack — Ars Technica AI
- The new AgentCore runtime: Elastic, optimized, and consistently fast starts — AWS Machine Learning Blog
- Qwen Image 2.1 PR to ComfyUI — r/StableDiffusion
Get the daily brief of stories like this at 6:30 every morning →