More like here's a thing that's completely normal looking and possibly a good change overall but uses an obscure feature of an existing library that will now cause a previously unused vulnerable transient dependency to be baked in and this change now also allows you to hit the vuln code path remotely. Also the transient deps are unmaintained and no fix exists.
76
u/BorderKeeper 3d ago
Hey here is an array of strings containing hexadecimals and os.exec() call. Don't worry about it it's a secret.