Malicious Bitwarden CLI and OVHcloud Incidents Highlight Risks of Trusted Developer Tools

·5 views

In April 2026, a tampered version of the Bitwarden CLI was published to npm and remained available for roughly ninety minutes, during which it could read SSH keys, .env files, and cloud credentials from installing machines. In October, the official OVHcloud CLI repository was briefly compromised with a faulty build that was blocked after 94 minutes, following a customer report. The article argues that such trusted tools are hard for antivirus software to flag, since they run with the user's full file access. To limit this exposure, the author describes ghl-jail, an open-source Windows tool that restricts a command to a single project folder and blocks access to other files and, by default, the network. The author notes it reduces risk rather than guaranteeing protection against targeted attacks.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Flisk Splits Dockerfiles: Why Coding Agents Should Avoid Editing Them

Coding agents editing Dockerfiles can cause problems in larger projects, since they lack awareness of similar changes made across services. Flisk has two Dockerfiles, and its flisk up command builds only the generated one, which depends on local golden images that are not published. The plain Dockerfile written by flisk resource is only a starting point for builds outside Flisk and has not been verified as production-ready. Deployment-related files such as Helm charts are not generated by Flisk, so ports, images, and health paths can drift out of sync across them. The author recommends that agents focus on code inside containers rather than the surrounding configuration, and suggests bring-your-own Dockerfiles to narrow the gap between local and production builds.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Duplicate titles and meta descriptions on documentation sites hurt search results

Documentation sites often end up with many pages that share identical titles and meta descriptions, because new sections are copied from old ones and frameworks fill in missing front matter. Search engines expect a distinct, concise description for each page, and when many pages repeat one, they generate their own snippets, making results harder to tell apart. Common causes include pages opening with the same heading or admonition, versioned docs repeating every page, and site-wide descriptions applied wherever a page lacks its own. The article recommends setting unique title and description fields in each page's front matter and checking the built HTML to see what crawlers actually read. It also suggests command-line checks and site-audit tools to locate duplicates across a build or live site.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

HackAVP: jury to select finalists from 10 submissions before November pitches

The HackAVP hackathon in New Caledonia closed submissions on October 21, and its jury will pool scores on October 26 to choose the finalists. Each team was required to submit a dev.to article and a demo video showing the full chain from candidate profile to generated documents. Judging uses a 100-point grid covering the common base, technical quality, HR value and track-specific criteria. Two tracks compete: SaaS without limits, which allows any cloud service, and sovereign on-premise, which runs value and orchestration layers on hardware operated locally. Finalists will pitch and receive awards at the public announcement on November 5 at Tech'N Co.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds PhoneEar to play Mac audio through iPhone headphones

A developer who wanted to watch a show on their MacBook late at night without waking others built PhoneEar, an open-source tool. It routes the Mac's sound to play through whatever headphones are plugged into or paired with an iPhone. No iPhone app is required, as the tool runs in Safari on the Mac. During development, audio sounded about 9% too fast because macOS reported a 48,000 Hz sample rate while the MacBook speakers actually run at 44,100 Hz. The project's code is publicly available on GitHub for others to try, fork, or suggest improvements.

0 comments Read more at DEV Community