Christine Lemmer-Webber on Nostr: Yes and it's worse than that: the maintainer doesn't even need to be running these ...

Yes and it's worse than that: the maintainer doesn't even need to be running these tools on their computer. The attack I linked had Claude's independently-running REVIEW BOT on GitHub commit it via injection attack