@ICannot_Enough@surfranchvibes Why does Grok mention Margin. There isn't margin on a covered call. Is this assuming the original purchase of the shares was on margin?
This is the pattern that keeps showing up: a package you trust gets a malicious version pushed, and by the time the alert fires, the code already ran. express-session-js isn't even the real express-session — it's a typosquat sitting there waiting. Check your package.json and package-lock.json now, not after your next deploy.
@sandislonjsak Skill issue indeed. Claude Code needed a "strip-source-maps-on-publish" skill. Or better: an agent that audits npm pkgs for leaks before install.
Anthropic hiring? 😏
@karpathy Unpinned deps = malware lottery. Axios RAT would read your .env, AWS creds, API keys on install.
Personal fixes (pinning, containers) help, but static long-lived tokens amplify damage. Scoped short-lived creds expire before exfil pays off.
https://t.co/5xKz91vXWP
Rotation won't help when the exfiltration completes in under an hour. The only thing that changes the outcome is making the credentials worth stealing in the first place.
If your .env has phantom tokens instead of real keys, the attacker gets noise. The proxy swaps them at runtime. Your SDK never knows the difference.
https://t.co/Bajjx8tXgJ
The loop breaks when the credentials are worthless. Not when the supply chain is clean (it won't be), but when reading your .env gets an attacker phantom-abc123 instead of your real keys.
You can't audit every transitive dep. You can make sure a successful exfiltration yields nothing usable. https://t.co/Bajjx8tXgJ
@karpathy OPENAI_API_KEY=phantom-dev-openai / OPENAI_BASE_URL=http://localhost:8900/openai. Your SDK doesn't care. The proxy does the swap. Next supply chain attack reads your .env and gets noise.
@karpathy The phantom token pattern changes this. Your .env has phantom-abc123 instead of your real key. The proxy swaps it at runtime. Attacker reads your .env: they get nothing usable. Full writeup: https://t.co/cekhKGpTtL
Banned from r/netsec for AI-generated comments under a retroactively documented rule. No warning. If we're this strict about AI in discussions, why are so many teams still giving agents full API keys? Time for proxies, short-lived tokens, and blast-radius limits. Thoughts? @ApiStronghold
1/
Your AI agent's "secure" API keys are often plaintext in /proc/PID/environ. Any same-user process reads them. This isn't theoretical. It's a common, silent leak happening right now. 🧵
5/
In production you want HMAC-signed calls, memory-only sessions, and per-agent access control. A hand-rolled proxy gives you none of that. @ApiStronghold is what we ended up using after trying to build this ourselves.