https://hackyjs.com/posts/auditing-plugin4shell-auto-load-paths-in-claude-code-codex-copilot-and-gemini-cli Hacky JS en 2026-09-19T00:00:00.000Z Auditing Plugin4Shell Auto-Load Paths in Claude Code, Codex, Copilot, and Gemini CLI security, ai-coding-agents, rce, supply-chain, developer-tools https://hackyjs.com/posts/why-a-github-repo-is-not-a-trust-signal-the-rapuncel-lastpass-campaign Hacky JS en 2026-09-19T00:00:00.000Z Why a GitHub Repo Is Not a Trust Signal: The Rapuncel LastPass Campaign security, malware, github, supply-chain, lastpass https://hackyjs.com/posts/docker-sandboxes-macos-host-escape-what-guest-code-can-read-and-modify Hacky JS en 2026-09-18T00:00:00.000Z Docker Sandboxes macOS Host Escape: What Guest Code Can Read and Modify docker, container-security, macos, sandbox-escape, devsecops https://hackyjs.com/posts/reverse-engineering-the-brevo-clickfix-injection-how-a-trusted-marketing-script-became-a-dropper Hacky JS en 2026-09-18T00:00:00.000Z Reverse-Engineering the Brevo ClickFix Injection: How a Trusted Marketing Script Became a Dropper supply-chain-attack, clickfix, third-party-scripts, content-security-policy, brevo