They sent 3 warnings to my email, ok, I understand bugs happen (probably vibe-coded). But they didn't even send any notification that it's a bug. Going to leave AWS after that.
23 karma · joined December 1, 2021
Insane
1. Malware uses a "preinstall" NPM script, which is triggered upon you running `npm install`.
2. Malware installs `bun`.
3. Then it installs and starts `trufflehog` (a tool for scanning code for secrets, API keys, passwords, etc.).
It seems many of their other NPM packages also have the same problem. https://www.npmjs.com/~timgl (all published 5 hours ago)
In `package.json`, it has a script `"preinstall": "node setup_bun.js"` + files `setup_bun.js` and `bun_environment.js` which are apparently is the malware.
Surprisingly, around 50% of all users trying to check out the tool are using mobile phones.
So, adapted it for small screens and touch devices.
1-min demo: https://youtube.com/shorts/jGDsSULzkAA?feature=share
The main problem with AI (aka vibe coding) is that you can start very easily and, in one or two prompts, receive an impressive start for your website or app.
But once you want to change, fix or improve something, that's where you can lose your money. It always feels "almost there, but not yet".
That's exactly where the wysiwyg/drag-n-drop UX comes to the rescue.
And some smart vibe-coding tools (e.g. Lovable) started adding visual development capabilities.
1. UI (visual editor) that produces a schema of an application (sometimes it's called DSL (domain-specific language), or AST (abstract syntax tree), or meta-model (as @speedgoose wrote)).
2. Interpreter/compiler that converts the schema/DSL/AST/model of your application into the code. Sometimes it's compiling real text code like HTML/JS/CSS. Sometimes it's interpreting in runtime.
Usually, it should do both. Code for the output/export/deploy. Runtime for your editor's canvas or preview mode.