Johnny On Crypto

Husband, Software Developer, Gamer, Soccer & lots of other sports

#Bitcoin #Ethereum @ElrondNetwork

@SpaceRiders_nft @meetnippy

[Johnny On Crypto @JohnnyOnCrypto]

#NewProfilePic 2.0 - meet Vision #2351 😉 Let's go to the space, riders 📷I'll see you up there 📷

@SpaceRiders_NFT
#SpaceRidersNFT #Spaceriders

[Anthony Pompliano 🌪 @APompliano]

I have changed my mind on how AI will impact jobs in America.

Previously, I believed AI would replace many entry level roles typically filled by young employees. The technology would then work its way up the organization and eventually reduce the total number of jobs in a company.

The data is saying something different, so when I get new information I am willing to change my mind.

The number of software engineers being hired has been increasing. The number of open software engineer roles is growing.

The number of new college grads who get hired has increased 5.6% over the last 12 months. The unemployment level for people aged 20-24 years old who have a college degree has fallen from nearly 9% to almost 5% as well.

The Wall Street Journal recently wrote “AI created 640,000 jobs between 2023 and 2025 in the U.S., according to an analysis by LinkedIn of job posting data, including new white-collar positions such as Head of AI and AI engineer.”

And I am starting to see companies throughout our portfolio aggressively hiring to keep up with the demand for their products and services.

If AI can make employees more productive, which is widely accepted as fact, then companies are going to want as many productive units of labor as possible. This is a key reason why I am changing my mind.

AI appears to be a magical technology that will make companies more productive and more profitable. The net result will be more corporations, more startups, and more jobs.

All three are big, positive wins for the American economy.

[Jeremy @Jeremybtc]

Anthropic accidentally leaked their entire source code yesterday. What happened next is one of the most insane stories in tech history.

> Anthropic pushed a software update for Claude Code at 4AM.

> A debugging file was accidentally bundled inside it.

> That file contained 512,000 lines of their proprietary source code.

> A researcher named Chaofan Shou spotted it within minutes and posted the download link on X.

> 21 million people have seen the thread.

> The entire codebase was downloaded, copied and mirrored across GitHub before Anthropic's team had even woken up.

> Anthropic pulled the package and started firing DMCA takedowns at every repo hosting it.

> That's when a Korean developer named Sigrid Jin woke up at 4AM to his phone blowing up.

> He is the most active Claude Code user in the world with the Wall Street Journal reporting he personally used 25 billion tokens last year.

> His girlfriend was worried he'd get sued just for having the code on his machine.

> So he did what any engineer would do.

> He rewrote the entire thing in Python from scratch before sunrise.

> Called it claw-code and Pushed it to GitHub.

> A Python rewrite is a new creative work. DMCA can't touch it.

> The repo hit 30,000 stars faster than any repository in GitHub history.

> He wasn't satisfied. He started rewriting it again in Rust.

> It now has 49,000 stars and 56,000 forks.

> Someone mirrored the original to a decentralised platform with one message, "will never be taken down."

> The code is now permanent. Anthropic cannot get it back.

Anthropic built a system called Undercover Mode specifically to stop Claude from leaking internal secrets. Then they leaked their own source code themselves. You cannot make this up.

[Beelink @Beelinkofficial]

Beelink SER10 Max — OpenClaw Pre-installed Series. Available now.🦞

👇Two versions:
• Ubuntu + OpenClaw + local AI model
• Windows + Ubuntu + OpenClaw + local AI model

🚀Powered by AMD Ryzen™ AI 9 HX 470. Available in the exclusive Lobster Red color.

🔗Learn more: https://t.co/gmoPimNiTb

#OpenClaw #SER10Max #LocalAI #AIDeployment #Ubuntu #AMD #RyzenAI

[TFTC @TFTC21]

A hacker group just compromised one of the most widely used security scanners in the world, and used it to steal half a million credentials from companies that trusted it to keep them safe.

On March 19, a threat actor group called TeamPCP injected credential-stealing malware into Trivy, a popular open-source vulnerability scanner maintained by Aqua Security. Trivy is used by thousands of companies to scan their code and infrastructure for security flaws. The attackers compromised 75 GitHub Action tags, the Trivy Docker images, and related CI/CD pipelines, meaning every company running automated security scans through Trivy was unknowingly executing the attackers' code.

The malware harvested SSH keys, cloud credentials, Kubernetes secrets, cryptocurrency wallets, and .env files from every environment it touched. The stolen data was encrypted and exfiltrated to attacker-controlled servers.

But the attack didn't stop there. Using credentials stolen from Trivy's CI/CD pipeline, TeamPCP then backdoored LiteLLM, a widely used Python framework for managing AI model APIs. Two malicious versions (1.82.7 and 1.82.8) were pushed to PyPI, the main Python package repository. The second version was designed to execute automatically on every Python process startup in the environment, no user interaction required. From there, it deployed privileged pods across entire Kubernetes clusters and installed persistent backdoors on every node.

The attackers also pushed compromised Docker images of Trivy (versions 0.69.4, 0.69.5, 0.69.6) to Docker Hub and compromised dozens of npm packages with a self-spreading worm called CanisterWorm. They even defaced 44 internal Aqua Security repositories in a scripted 2-minute burst, renaming them all with "TeamPCP Owns Aqua Security."

According to the International Cyber Digest, which is in direct contact with the attackers, TeamPCP claims to have exfiltrated 300 GB of compressed credentials and is actively working through them. The LiteLLM compromise alone reportedly yielded half a million stolen credentials. The group says it is currently extorting several multi-billion-dollar companies.

Each compromised environment yielded credentials that unlocked the next target. The pivot from CI/CD pipelines to production Python packages running in Kubernetes clusters was deliberate escalation. Security researchers say this campaign is "almost certainly not over."

This is what a modern supply chain attack looks like. The tools companies trust to secure their infrastructure become the attack vector. The irony is brutal, the security scanner was the vulnerability.

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Johnny On Crypto @JohnnyOnCrypto]

@VadimStrizheus All?

[Johnny On Crypto @JohnnyOnCrypto]

@mchulet https://t.co/ffZQhWqMhz 🙏🏻🫡

[Johnny On Crypto @JohnnyOnCrypto]

@foundrceo https://t.co/ffZQhWqMhz

[Johnny On Crypto @JohnnyOnCrypto]

@victor_bigfield https://t.co/ffZQhWqMhz 🙏🏻🫡

[Johnny On Crypto @JohnnyOnCrypto]

@DavidOndrej1 I do this all the time, it's a habit now 😄😅

[Johnny On Crypto @JohnnyOnCrypto]

@ClimStefan https://t.co/ffZQhWqMhz 🫡

[Johnny On Crypto @JohnnyOnCrypto]

@BatsouElef https://t.co/ffZQhWqMhz

[Johnny On Crypto @JohnnyOnCrypto]

@md_kadiwal https://t.co/ffZQhWqMhz

[Johnny On Crypto @JohnnyOnCrypto]

@andrewchen Try https://t.co/ffZQhWqMhz with /remote-control 💪🏻

[Johnny On Crypto @JohnnyOnCrypto]

@csaba_kissi https://t.co/ffZQhWrk77

[Johnny On Crypto @JohnnyOnCrypto]

@jeffzwang https://t.co/HxszqlGJ82

[Ionut Tepus @ionutz0914]

I built claive — multi-agent orchestrator for Claude Code. One goal → parallel agents, each on its own git branch. One-shot full applications. Open source: https://t.co/xEGaLTN3Mh

[Johnny On Crypto @JohnnyOnCrypto]

@jeffzwang thank me later 🫡
https://t.co/HxszqlGJ82

[Ionut Tepus @ionutz0914]

I built claive — multi-agent orchestrator for Claude Code. One goal → parallel agents, each on its own git branch. One-shot full applications. Open source: https://t.co/xEGaLTN3Mh

[Johnny On Crypto @JohnnyOnCrypto]

@jeffzwang I built myself a combination of https://t.co/TJfPoy9mZu and https://t.co/ueMPQwiBiM - works really good so far - I was able to oneshot 2 apps since yesterday with claude code - Medium Effort 🫡

[Ionut Tepus @ionutz0914]

I built claive — multi-agent orchestrator for Claude Code. One goal → parallel agents, each on its own git branch. One-shot full applications. Open source: https://t.co/xEGaLTN3Mh

[Johnny On Crypto @JohnnyOnCrypto]

@md_kasif_uddin curiosity and communication 🫡