{"version":"2.1.275","anchor":"dangerous-env-var-regex-now-flags-nlspath-and-developer-dir","canonical_anchor":"dangerous-env-var-regex-now-flags-nlspath-and-developer-dir","heading":"Dangerous-env-var regex now flags NLSPATH and DEVELOPER_DIR","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.275\/e\/dangerous-env-var-regex-now-flags-nlspath-and-developer-dir","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.275","markdown":"### Dangerous-env-var regex now flags NLSPATH and DEVELOPER_DIR\n\nClaude Code now flags NLSPATH and DEVELOPER_DIR as potentially hijacking environment variables\n\n**What**\n\nClaude Code checks environment variables for ones that could hijack a command by pointing it at attacker-controlled code or libraries. That check now also catches `NLSPATH` and `DEVELOPER_DIR`, in addition to the existing `LD_`, `DYLD_`, `GCONV_PATH`, and `PYTHON`-prefixed variables.\n\n**Why**\n\n`NLSPATH` and `DEVELOPER_DIR` can be abused the same way as the variables already covered, so flagging them closes a gap in the safety check that warns about risky environment variable usage.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}