Jake Bolton ninmonkey

Posted reddit thread: https://www.reddit.com/r/PowerShell/comments/1von1d7/comment/p41z4et Date: 2026-08-15

The version currently up didn't appear to execute something malicious currently -- but it looks more suspicious than not.

The domain is not github, and the cert was invalid. Unlike the guy below, who said he got 404

hashed HOMEPATH and ComputerName
which version of the module you ran
Your powershell version

I found these CLAUDE.md examples that help mitigate when claude or external tools are executed ie: Cases where you can't just modify your profile

The problem is powerh

Traditional fix for current user

In the file $Profile.CurrentUserAllHosts add

function Pow { param( $base, $pow ) [Math]::Pow( $base, $pow ) }
filter  fPow { param( $Pow ) [Math]::Pow( $_, $pow ) }
filter  IPow { param( $Base ) [Math]::Pow( $base, $_ ) }
function Csv { $input | Join-String -sep ', ' }

3 Different interfaces

Pow 2 7

Explicitly calling `::new()`

using namespace System.Collections.Generic
$example = 9, 4, 3

[List[int]]::new( [int[]]$example )

I had to type it as an [int[]]

	#requires -Modules Pansies
	#requires -PSEdition Core
	remove-module PSFrameWork, psutil, string -ea ignore

	<#
	.SYNOPSIS
	parse a cisco router config from 10 years ago. split into groups. Show depths. Show warnings if any exit contained within
	.NOTES
	I used colors for a screenshot
	but if you use Num and DisplayNum you'd be able to have colors and still filter like

	#requires -Modules PSParseHTML
	<#
	.link
	javascript answer: https://gist.github.com/ninmonkey/b59e33cec6765a2c782edaf5c4807b17
	#>
	Import-Module PSParseHTML

	$url = 'https://tavex.pl/zloto/zlote-sztabki/page/1?filter%5Bweight%5D%5B0%5D=1&meta%5B0%5D=tax-gold%3Azlote-sztabki&sorting=recommended'

	$html ??= Invoke-WebRequest -url $Url -UseBasicParsing

	function EditFunc {
	<#
	.SYNOPSIS
	Finds where a function is defined, opens it in vs code -- and jumps to the line number it starts on
	.example
	gcm prompt \| EditFunc
	#>
	[CmdletBinding()]
	param(
	[Parameter(ValueFromPipeline)]

	filter EscapeCC {
	($_)?.EnumerateRunes() \| % {
	($_.Value -le 32) ? [Text.Rune]( $_.Value + 0x2400 ) : $_
	} \| Join-String
	}

	"sdf `a sdjf hi world`t`n ${fg:#feaa99} more stuff `u{0} `r`n blah" \| escapeCC

	# outputs: sdf␠␇␠sdjf␠hi␠world␉␊␠␛[38;2;254;170;153m␠more␠stuff␠␀␠␍␊␠blah

	let
	startDate = DateTime.Date( DateTime.LocalNow() ),

	endingOffset = 1000, // in days
	endingOffsetDate = Date.AddDays( startDate, endingOffset ),

	allDays = List.Transform(
	{ Number.From(startDate)..Number.From(endingOffsetDate) },
	each { Date.From( _ ) }
	),

	<html><body>
	<table class="cols-3">
	<tr>
	<th>Company</th>
	<th>Contact</th>
	<th>Country</th>
	</tr>
	<tr>
	<td>Alfreds Futterkiste</td>
	<td>Maria Anders</td>

Jake Bolton ninmonkey

Traditional fix for current user

Explicitly calling ::new()

Explicitly calling `::new()`