Sanjeev

Learner, Builder

[Sanjeev @ShipWithSanjeev]

@signulll Oh I already know 😊

[Sanjeev @ShipWithSanjeev]

@nikunj This is cool. I’m in Canada and Canada MLS doesn’t let public consumer facing sites provide the data about what price a property was sold.

[Sanjeev @ShipWithSanjeev]

@badlogicgames “AI is an incredible force multiplier for implementation, but it’s a dangerous substitute for design. It’s brilliant at giving you the right answer to a specific technical question, but it has no sense of history, taste, or how a human will actually feel using your API”

[Sanjeev @ShipWithSanjeev]

Architecture guardrails > Instructional guardrails.

If you can’t safely restrict agent to do something, it shouldn’t have that permission

[JER @lifeof_jer]

https://t.co/ofucbVgkLV

[Sanjeev @ShipWithSanjeev]

Same experience with opus vs codex. Codex for deep work. Especially with oh-my-codex

[antirez @antirez]

The difference between the two, for serious engineering work, is simply brutal. Claude Code with Opus is, when the task at hand is very complicated, borderline useless, while GPT 5.4 can do a reverse engineering mixing: hardware knowledges, major disassembly skills, and so on.

[Sanjeev @ShipWithSanjeev]

https://t.co/svXIkkemcJ

[Sanjeev @ShipWithSanjeev]

Didn’t realize gstack has telemetry on it. No go for me. I’ll still use the skill for reference and take the ones I need to use. Appreciate that. Thanks and no thanks

[Sanjeev @ShipWithSanjeev]

TIL type '!' within Claude Code and you can run bash commands

[Sanjeev @ShipWithSanjeev]

https://t.co/Qqfslftb46

[Sanjeev @ShipWithSanjeev]

Trivy's GitHub Actions had a workflow called "API Diff Check" that used pull_request_target as a trigger. The problem with pull_request_target is that it runs with the permissions of the base repository (Trivy's own repo), not the fork. But this particular workflow was configured to check out the PR's code (the fork's code) and it had access to a PAT with broad permissions, not just the default ephemeral GITHUB_TOKEN.

So the exploit was:

1. hackerbot-claw (an autonomous AI agent powered by Claude Opus 4.5, created Feb 20, 2026) opened a pull request from a fork
2. The pull_request_target workflow triggered, checking out the attacker's PR code
3. The attacker's code ran inside the CI runner with access to the repo's PAT (broad write permissions)
4. The payload exfiltrated the PAT to recv[.]hackmoltrepeat[.]com

With that PAT, the attacker deleted all 178 Trivy releases, privatized the repo, wiped stars, and published a malicious VS Code extension. Aqua Security rotated secrets during remediation, but the rotation wasn't atomic, so the attacker captured the refreshed tokens during the process. That retained access is what TeamPCP used three weeks later on March 19 for the full supply chain attack.

The root cause: a misconfigured GitHub Actions workflow that checked out untrusted fork code while holding a privileged PAT. A well-known anti-pattern, but still extremely common in open source repos.

GitHub Security Lab's original writeup on this exact anti-pattern (they coined the term "pwn requests"):

https://t.co/MWgl0ecBJQ

That's the canonical reference. Published in 2021, warns specifically that combining pull_request_target with an explicit checkout of untrusted PR code can lead to full repository compromise. Exactly what happened to Trivy five years later.

[Sanjeev @ShipWithSanjeev]

TeamPCP compromised Aqua Security's Trivy vulnerability scanner on March 19, 2026, hijacking trivy-action and setup-trivy GitHub Actions and stealing CI/CD secrets from organizations running them.

Between March 21-22, stolen credentials led to compromises of Checkmarx KICS, Aqua Security Docker images, and packages across GitHub Actions, Docker Hub, npm, Open VSX, and PyPI.

On March 24 at 10:52 UTC, LiteLLM versions 1.82.7 and 1.82.8 were uploaded to PyPI using stolen publish tokens. LiteLLM used Trivy in its CI/CD pipeline. Neither version had a corresponding GitHub tag or release. 1.82.7 injected malicious code in proxy_server.py, executed on module import. 1.82.8 added a .pth file that Python executes on every interpreter startup without any import.

The payload collected SSH keys, cloud credentials (AWS, GCP, Azure), Kubernetes secrets, .env files, crypto wallets, and database passwords, encrypted everything with AES-256 + RSA-4096, and sent it to models.litellm[.]cloud. On Kubernetes hosts, it deployed privileged pods to every node and installed a systemd backdoor polling checkmarx[.]zone.

A bug in the .pth launcher caused recursive process spawning that crashed machines. A FutureSearch engineer found it when litellm was pulled as a transitive dependency by a Cursor MCP plugin.

The malicious versions were live for approximately 9 hours. Roughly 500K exfiltration attempts reported. Both versions removed from PyPI. 1.82.6 is clean.

[Andrej Karpathy @karpathy]

Software horror: litellm PyPI supply chain attack.

Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.

LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.

Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.

Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.

Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.

[Sanjeev @ShipWithSanjeev]

openclaw is the first software system that you can ask to update itself and it does it for you

[Sanjeev @ShipWithSanjeev]

Helping few setup their openclaw. I gave them all the instructions but the learning curve is real for anyone not used to command line tools, models etc. easy to get overwhelmed. No wonder there are ppl who are ready to pay 5k per install. Install is just the start, there is a lot of upkeep to make it reliably smart

[Sanjeev @ShipWithSanjeev]

Half the bugs I've seen in production started with someone solving the wrong problem really well.

[Sanjeev @ShipWithSanjeev]

I frequently explain the xy problem to folks I work with.

pretty interesting how frequently I run into this. someone would ask how to solve y. immediately im like 'whats the context'? then they will say I have a problem x and I'm looking to solve that with y and run into a problem with y. y may not even be the best way to solve x.

lot of time is saved when someone asking for question gives the context of the "actual" problem along with the problem of the perceived solution.

[Sanjeev @ShipWithSanjeev]

Automated code review is a game of whack-a-mole.

Push a change, get comments. Fix one, two more appear. The tool is designed to give feedback — so it always will, whether it's useful or not.

Same with inline suggestions. I see a team using Copilot and their #1 complaint: it keeps suggesting things they doesn't want. More time dismissing than accepting.

The core problem is the same: these tools review code with zero context. No intent. No trade-offs. No "what's intentionally out of scope."

Verification should shift left to the intent, not the diff.

Review the plan. Challenge the plan. Then review the code against the plan. That's a useful review.

[Sanjeev @ShipWithSanjeev]

Lot of tutorials to optimize the openclaw setup. You need to DIY. That’s the whole fun part of this. Just ask your claw.

[Sanjeev @ShipWithSanjeev]

I see lot of courses to _teach AI_

Let’s say the course is $100.

Spend $100 worth of tokens and you will learn lot more doing that.

Doing is the learning.

[Sanjeev @ShipWithSanjeev]

@nikunj @Bfaviero Thanks for sharing