OpenHands

Image from iOS.jpg

Because of ~18 minutes of exposure total, apparently

Wow, TeamPCP is really wrecking things recently

If you are using VSCode/cursor, the next attack vector will likely be extensions, so audit your editor folks

Because of how this has spread thus far, we simply cannot take "very few compromised" as an empirical finding.

Yeah, it's a known vector, but it's not obvious how it will stop when the editor will auto-update, the developer just clicks once...

this sandworm isn't going away any time soon