And AI coding agents often want extensions from npm... [LWN.net]

And AI coding agents often want extensions from npm...

Posted Aug 5, 2026 17:14 UTC (Wed) by ejr (subscriber, #51652)
Parent article: Another npm worm

What possibly could go wrong? And being someone who would expect to see something named Math_Symbol.js appear because of my specialties, well...

Found a Math_Symbol.js in a llama.cpp ui build on 1 July under regenerate-unicode-properties. It looks pre-worm (three non-obfuscated lines that just add ranges to a set), but I am annoyed that I had to look.

to post comments

And AI coding agents often want extensions from npm...

Posted Aug 5, 2026 17:22 UTC (Wed) by ejr (subscriber, #51652) [Link]

BTW, if running over a large set of directories, the equivalent fd / fd-find / fdfind commands appear to be the following:

fdfind -HI -t f -p '.*\/node_modules\/.*(Math_Symbol\.js|math_init\.js)$' ~

fdfind -HI -t f -p 'node_modules/.*/setup.mjs' ~ -x sh -c "grep -q oven-sh/bun {} && echo SUSPICIOUS: {}"

These only popped up the one (false) positive for me, and they're partially LLM-generated translations, but they might save you a bit of typing. Nothing is wrong with find. These simply seem faster if going though TBs of directories.