myninja injects C.
Silently injects third-party code into your project without disclosure
While building, I found a scrip tag pointing to sites .super.myninja. ai/_assets/ninja-daytona-script.js sitting in my own HTML file — code I never wrote and was never told about. No warning during setup, no mention in docs, nothing. I only caught it because I had a second pair of eyes reviewing the codebase. For context: this is an app with access to downloads, tabs, and browsing data. Finding an unexplained, unversioned third-party script silently pulling from your servers into that kind of privileged code is exactly the sort of thing that should require explicit, upfront consent — not something a user has to discover by manually auditing their own files. Had to strip it out myself once I found it. If you're going to inject anything into a user's project, disclose it clearly before it happens.



