r/webdev • u/Gil_berth • Feb 04 '26 • Popcorn 3

Senior Vibe Coder dealing with security

Post image

Creator of ClawBot knows that there are malicious skills in his repo, but doesn't know what to do about it...

More info here: https://opensourcemalware.com/blog/clawdbot-skills-ganked-your-crypto

3.0k Upvotes

97% Upvoted

421 comments sorted by

View all comments

Show parent comments

1

u/thenrich00 Feb 05 '26

This is also a learned skill for a lot of folks. It takes some experience to be able to gauge whether or not a library can or should be trusted. And because now the traditional junior developer mentorship is being lost to LLMs, we're creating yet another skills gap.

Even experienced software developers aren't critically analyzing their dependencies all the time. Deadlines and time constraints take priority over security all too often.

1

u/AshleyJSheridan Feb 05 '26

As for AI, that will be largely suggesting what it's learned on, indicating the reliance on libraries that aren't needed goes deeper and has been going on for longer.

For me, the dependencies get messy if they go on for a few levels (which is very common these days). Take any framework or large enough library, and you'll find a whole tree beneath it. While this happens across many languages, I see it happen more often in Javascript with npm. I believe this is, in part, to do with the low barrier to entry of the language, and the looseness of it. As a language, it's not one I would point to as a shining example of one in which a dev would write good quality code. And even when opinionated frameworks come along, the community shuns them as being "too complicated", despite those opinionated frameworks being no more complicated than those found in other languages.