StepSecurity's writeup on the hijacked Bitwarden CLI (npm 2026.4.0) put ~/.cla… · @yinpengxuan · TwKit

@yinpengxuan

StepSecurity's writeup on the hijacked Bitwarden CLI (npm 2026.4.0) put ~/.claude.json and MCP configs on the same target list as SSH keys and .npmrc. I'd keep MCP tokens out of plain JSON and give each agent its own narrow key. Do you rotate yours?

曝光 1 · 评论 0 · 点赞 0 · 书签 0