You'll notice
Claude Code now flags NLSPATH and DEVELOPER_DIR as potentially hijacking environment variables
What
Claude Code checks environment variables for ones that could hijack a command by pointing it at attacker-controlled code or libraries. That check now also catches NLSPATH and DEVELOPER_DIR, in addition to the existing LD_, DYLD_, GCONV_PATH, and PYTHON-prefixed variables.
Why
NLSPATH and DEVELOPER_DIR can be abused the same way as the variables already covered, so flagging them closes a gap in the safety check that warns about risky environment variable usage.