Bhashkar Sharma

On Bluesky: threads @bhashkarsharma

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Bhashkar Sharma @BhashkarSharma]

@HagermanHour @cmuratori I am reminded of this talk
https://t.co/n3rXvZxWLV

[Bhashkar Sharma @BhashkarSharma]

@rob_kopel @localghost Computer use incurs a lot of wasted resources for no good reason, if agents are to become the primary navigators of the web.

Most modern web apps are already JS bundles powered by APIs (REST, GraphQL etc).

[Bhashkar Sharma @BhashkarSharma]

@brendanhanson @kepano Have you tried Fava and Beancount? I like it specifically because it’s plaintext. https://t.co/tLfsxFYfYW

[Bhashkar Sharma @BhashkarSharma]

#Duolingo365

[Bhashkar Sharma @BhashkarSharma]

@morphillogical @ibuildthecloud @mjackson Preact also provides an API to use it without any build tools.

https://t.co/LSBoZgmtSP

[Bhashkar Sharma @BhashkarSharma]

@ritakozlov I’m building a “second brain” app using KV, R2, etc.

However, getting AutoRAG to work on files stored in R2 has been a pain. Spent many hours trying to get it to work.

Please see attached screenshot for details.

[Bhashkar Sharma @BhashkarSharma]

@ICooper @GergelyOrosz Also known as the Android strategy.

[Bhashkar Sharma @BhashkarSharma]

@jeremyphoward Looks really cool!

I’ve been using this tool with iTerm for a while. Does a good job of translating natural language into shell commands, although it doesn’t have access to the context:
https://t.co/GTBXQQsRMO

[Bhashkar Sharma @BhashkarSharma]

@ObservingAngel @drgurner This reminded me of a study from the early iPhone era.

https://t.co/iY12bkl8bo

[Bhashkar Sharma @BhashkarSharma]

@threepointone Pretty sure I’ve seen some YouTubers promoting their courses on this.

[Riley Goodside @goodside]

“I don’t even see the R’s. All I see is 302, 1618, 19772, 198, 3504, 1134, 19772, 198, 101830, 198, 138322, 198, 1100, 302, 1618, 19772, 25644, 1100, 3504, 1134, 19772, 1100.”

[Bhashkar Sharma @BhashkarSharma]

If Apple made this with a folding magnetic keyboard, coupled with the M series chips and all-day battery, they could build a single device to rule them all.

But they wouldn’t want to kill 2 of their big product lines.

[Ben Geskin @BenGeskin]

The world's first trifold phone is here❗️

Huawei Mate XT | Ultimate Design
Starting at ¥19999 ($2800)

[Bhashkar Sharma @BhashkarSharma]

@threepointone @sorenbs I have noticed multiple times in the last week that:
- given a good description of the problem, Claude’s first output is closer to what I want
- when asked to make specific improvements to the code, gpt-4o tends to get stuck in a loop, while Claude actually seems to make progress

[Bhashkar Sharma @BhashkarSharma]

More of this please.

[Kenneth Reitz @kennethreitz42]

Switzerland now requires all government software to be open source https://t.co/SlKjzwHxDA

[Bhashkar Sharma @BhashkarSharma]

The Y2K nobody saw coming.

[Troy Hunt @troyhunt]

Something super weird happening right now: just been called by several totally different media outlets in the last few minutes, all with Windows machines suddenly BSoD’ing (Blue Screen of Death). Anyone else seen this? Seems to be entering recovery mode:

[Bhashkar Sharma @BhashkarSharma]

Remember how corporations always claimed that taking their content without paying for it was a crime?

Turns out the rules don’t apply to them. OpenAI, Perplexity, Microsoft, and others are stealing from the web without paying for it, while the resulting products are paywalled.

[Tsarathustra @tsarnick]

Microsoft AI CEO Mustafa Suleyman: the social contract for content that is on the open web is that it's "freeware" for training AI models