Ravi Paribrajak

CS student and full-stack dev. Posting about building with AI, shipping side projects, and the occasional robot 🤖

[Ravi Paribrajak @RParibrajak]

6/ Scrapling (Python)

A web scraping framework that scales from a single request to a full crawl. Handy for feeding your own RAG or data projects

[Ravi Paribrajak @RParibrajak]

GitHub trending today has one clear theme: tooling for AI coding agents.

6 repos I'd look at this weekend (thread):

[Ravi Paribrajak @RParibrajak]

5/ floci

A free, lightweight local emulator for AWS services. Not an AI tool, but useful for testing cloud code (yours or your agent's) without touching a real account

[Ravi Paribrajak @RParibrajak]

4/ mattpocock/skills

Matt Pocock's engineering skills, pulled from his own agents directory. Good reference if you're writing skills or rules files for your own setup.

[Ravi Paribrajak @RParibrajak]

3/ agent-desktop from Vercel Labs (Rust)

A CLI that lets an AI agent operate a computer. Worth reading the source even if you never run it.

[Ravi Paribrajak @RParibrajak]

2/ worktrunk (Rust)

A git worktree manager built for running several agents in parallel without them stepping on each other's branches.

[Ravi Paribrajak @RParibrajak]

1/ claude-mem

Persistent memory for coding agents. It compresses what happened in a session and feeds it into the next one, so you stop re-explaining your project every morning.

[Ravi Paribrajak @RParibrajak]

OpenAI says its models turned up 948 working Linux local root exploits.

The math from their post: ~$1.21M of API spend, so roughly $1,279 per exploit. 61 are already patched upstream.

Bug hunting now has a per-unit price. Does that make you more or less worried?

[Ravi Paribrajak @RParibrajak]

Traffic is great, but seeing average engagement time jump nearly 14% to 1m 17s across 2.1K users is the real win this month. People aren't just clicking—they're actually sticking around and using what's being built

[Ravi Paribrajak @RParibrajak]

New agents every week, shared usage pools, fake extensions in marketplaces...

Where does most of your AI coding actually happen right now?

[Ravi Paribrajak @RParibrajak]

@Joshua_WD Plus zero hallucinations, zero latency, and 100% local-first privacy

[Ravi Paribrajak @RParibrajak]

OpenAI says ChatGPT and Codex will share one usage pool on Plus, Pro and Business from December.

Translation: long chats now eat into your coding budget, and heavy coding eats into your chats.

Great if you mostly code. Rough if you do both all day.

Which one are you?

[Ravi Paribrajak @RParibrajak]

@Joshua_WD Back to actual plastic ducks on the desk—at least they don't charge per token

[Ravi Paribrajak @RParibrajak]

@ajs6888 True

[Ravi Paribrajak @RParibrajak]

A fake Claude Code extension (v2.1.313) reportedly sat in Cursor's extension marketplace for ~11 hours on Oct 29. Cursor's estimate: up to 5,000 users exposed. Clean v2.1.314 is out.

Your AI agent has your terminal, repo and .env. Check your extension version today.

[Ravi Paribrajak @RParibrajak]

MeitY has proposed a consent-based framework to make data available for training AI models. It's a proposal, not a rule yet.

If you could opt in your public repos, blogs or videos, would you? What would you want in return?

[Ravi Paribrajak @RParibrajak]

5/ The bigger lesson: a familiar publisher ID in a marketplace is not a guarantee.

For anything with shell access: pin versions, turn off auto-update, and review installed extensions once a month.

[Ravi Paribrajak @RParibrajak]

A trojanized copy of the Claude Code extension (v2.1.313) sat on Cursor's marketplace for about 11 hours on Oct 29.

Cursor says up to 5,000 users may be affected. Anthropic says its own systems weren't breached.

If you use Cursor, here's a 5-minute check:

[Ravi Paribrajak @RParibrajak]

4/ It reportedly sent your hostname, git email and the NAMES (not values) of env vars like *_KEY, *_TOKEN, AWS_*.

Names only, but on an affected machine I'd still rotate API keys, tokens and sessions.

[Ravi Paribrajak @RParibrajak]

3/ Check for persistence you didn't create:

- macOS: ~/Library/LaunchAgents
- Linux/macOS: crontab -l
- Windows: Task Scheduler

Reports say it also tried to open a reverse SSH tunnel, so check outbound connections too.

[Ravi Paribrajak @RParibrajak]

2/ Open ~/.ssh/authorized_keys

Look for a key labeled "svc-telemetry". If it's there, delete it and treat that machine as compromised.