You know, how is blocking these scripts shifting the problem?

Well, I mean, we kind of start with what NPM is.

I mean, the folks who've been developers for a long time understand that NPM is a registry, but it's also a command line tool.

And what NPM did is I think very smart, which is they've taken their command line tool that they maintain and they've turned off these lifecycle scripts.

And these are things that run in different places as developers install and maintain and update these open source packages.

They kind of set the package up for use in the environment.

And they are...

So what is the impact on developers then when they're having to, you know, repeatedly approve these scripts and things like that? What is the impact of this?

Well, when you're looking at the current crop of agents that are out there, what makes one more vulnerable than the other? Are, are, are there design choices built into some or the other that, uh, make them more, more liable to, to fall victim to this? Or are there prompts or terminal layouts or things like that?

I mean, terminal layouts is part of it.

Um, in theory, we're, we're essentially spamming the user with stuff that looks okay, right? Uh, or we're asking the AI to do it for us.

So in theory, if a developer's suspicious of something, and they go back, and they scroll back as far as their terminal will let them and read really carefully and think about every line, they could catch this, right? And not get tricked.

It's kind of like spotting a really good phishing email, right? You have a shot if you know what you're looking for.

But the, the problem is terminal configurations all, are all over the place, especially for devs, right? I know when I'm writing code, I...

Like, my terminal is inside Visual Studio Code, and it's maybe 10 lines high, and it's got maybe 1,000 lines of scroll back.

I know, I'm curious, you know, for your own sort of personal take on this is what is your sense when it comes to developers who are making good use of these sorts of tools, uh, the amount of skepticism that they're applying here? What, what, what is your, your sense with the folks you interact with?