Rodrigo Moreno

Head of Engineering @FluxQR; Node.js + DevOps;

[Jiahan Chen @jiahan_c]

Small CI tip:

On Node.js 22+, use `node --run <script>` instead of `pnpm run <script>` for simple package scripts in GitHub Actions.

Tiny change, saves 200-400ms per call.

[Rodrigo Moreno @RodMoreno_]

Otro día más sin que la @LaAgenciaCDMX pueda entregarnos la MI Digital para usuarios iOS.

[Astro @astrodotbuild]

Astro 7 is here! A new Rust compiler, a new Rust Markdown/MDX processor, Vite 8 and more. Get ready for 60%+ faster builds.

https://t.co/RG0CPr6IUF

[Rodrigo Moreno @RodMoreno_]

@MrElDiablo8 ¡Órale! ¿Era un vehículo autónomo a exceso de velocidad? Porque si no es el caso el que choca es un conductor irresponsable o inexperimentado.

[mixbits @mixbits]

A 6 días del #Mundial2026 la tarjeta MI del transporte de la #CDMX aún no es compatible con la billetera de Apple ☹️

[Homero J. Sánchez @HomeroJSanchez]

A dos semanas del mundial en Atlanta agregaron su tarjeta de movilidad en wallet mientras tanto @LaAgenciaCDMX con su ajoloapp pedorra.

[Rodrigo Moreno @RodMoreno_]

No pues chido con @luunamx subiendo 11% sus colchones respecto al mes de Marzo, así presentando sus supuestas ofertas para el #HotSale

[Rodrigo Moreno @RodMoreno_]

@rjgomezg @cynsol Yo hice prueba con un amigo, y si podía recibir SMSs, obviamente enviarlos no

[Zed @zeddotdev]

You can now use your ChatGPT subscription in the Zed agent, with the same usage and rate limits you benefit from in Codex directly. We're grateful that @openaidevs continues to support subscription-based access for third-party tools, even as others move toward usage-based billing.

[Feross @feross]

The rate of npm supply chain attacks is so great that "the latest npm security incident" is ambigious after just a few hours...

This is now the latest attack: https://t.co/zUeBai6Onc

[Prasenjit @Star_Knight12]

Next.js just got its worst vulnerability ever, CVSS 8.6.

→ affects versions 13.4.13+, 14.x, 15.x, and 16.0.0–16.2.4
→ attackers can access your internal services, cloud credentials, API keys, and admin panels
→ no authentication needed
→ one crafted request is all it takes
→ roughly 79,000 instances are exploitable right now
→ vercel-hosted apps are safe, self-hosted are not

upgrade to 15.5.16 or 16.2.5 immediately.

[International Cyber Digest @IntCyberDigest]

‼️🚨 MAJOR IMPACT: AI just found an 18-year-old NGINX critical remote code execution vulnerability. It has been disclosed on GitHub including PoC code.

- Affects NGINX 0.6.27 through 1.30.0
- Triggered via the rewrite and set directives in config
- Update NGINX ASAP
- NGINX is a widely used HTTP web server, be sure to check its prevalence in other products

[Rodrigo Moreno @RodMoreno_]

Entre vulnerabilidades en Next.js, tanstack, ngnix y quien sabe quién más esto se ha vuelto más en solo estar actualizando archivos yaml de helm y package.json

[Rodrigo Moreno @RodMoreno_]

@matteocollina @nodejs Could this arrive as an official image of Node.js in the future? I'll probably start implementing it in my company's services

[Theo - t3.gg @theo]

For every person who replies with a screenshot of their cancelled Claude Code plan, I will donate $10 to open source.

[Node.js @nodejs]

Node.js 26.1.0 is out, with a new `node:ffi` module, `crypto.randomUUIDv7()`, and many more features and bug fixes.

Full changelog and download links: https://t.co/9VpqhfN1gE

[Zed @zeddotdev]

We've shipped more than a thousand versions of Zed, but all of them began with zero. Today, that changes.

https://t.co/AJ0crNOFhU

[DeepSeek @deepseek_ai]

🚀 DeepSeek-V4 Preview is officially live & open-sourced! Welcome to the era of cost-effective 1M context length.

🔹 DeepSeek-V4-Pro: 1.6T total / 49B active params. Performance rivaling the world's top closed-source models.
🔹 DeepSeek-V4-Flash: 284B total / 13B active params. Your fast, efficient, and economical choice.

Try it now at https://t.co/GCdiMzk1Dl via Expert Mode / Instant Mode. API is updated & available today!

📄 Tech Report: https://t.co/drlDrxkYtp
🤗 Open Weights: https://t.co/T13Y8i7SDM

1/n

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Rodrigo Moreno @RodMoreno_]

@kmcnam1 pg_strict