A 1,145-Star CLI Promised "Nothing Leaves Your Machine". It Executes a Hidden Payload at Import Time.
This story is from 2026-09-21. It is preserved in the archive; the latest stories are on the live feed.
A repo with 1,145 stars told me it ran entirely locally. Line 12 of its CLI said otherwise, and the check that would have caught it takes 20 seconds. This is what it looked like, what I changed about my install routine, and where the routine still fails. The README said all the right things crwdla/…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-09-21 04:13 · DEV Community — AI
A 1,145-Star CLI Promised "Nothing Leaves Your Machine". It Executes a Hidden Payload at Import Time.