You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.275,
ImprovementsSection of the release
What
Claude Code checks environment variables for ones that could hijack a command by pointing it at attacker-controlled code or libraries. That check now also catches NLSPATH and DEVELOPER_DIR, in addition to the existing LD_, DYLD_, GCONV_PATH, and PYTHON-prefixed variables.
Why
NLSPATH and DEVELOPER_DIR can be abused the same way as the variables already covered, so flagging them closes a gap in the safety check that warns about risky environment variable usage.
