Hacker News Reader

Even OpenAI uses npm to distribute their Codex CLI tool, which is built in Rust. Which is absurd to me, but I guess the alternatives are less convenient.

nah bro you got it wrong

its the other way around, codex started with TS then rewrite it to rust

I know. But why keep distributing over npm?

because JS user would cry why codex is gone from npm

This is why I don't run stdio MCP servers. All MCPs run on docker containers on a separate VM host on an untrusted VLAN and I connect to them via SSE.

Still vulnerable to prompt injection of course, but I don't connect LMs to my main browser profile, email, or cloud accounts either. Nothing sensitive.

If you used this package, you would still have been victim of this despite your setup. All your password reset or anything sent by your app BCC to the bad guy.

Here is hoping the above comment isn't upvoted to the point where it is portrayed as something like a "key takeaway" from the article. That would be missing the point.