Yuval Itzchakov

Husband, Father, Software Engineer, Music Lover & DJ. Co-Founder & CTO @ A

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Yuval Itzchakov @YuvalItzchakov]

@VictorTaelin Does anyone have an equivalent working flow for Android? Currently using tmux + Termius + tailscale, but using Termius on mobile with the keyboard layout doesn't play nicely for me and feels cumbersome.

[Or Hiltch @_orcaman]

Today we are launching @openwork_ai, an open-source (MIT-licensed) computer-use agent that’s fast, cheap, and more secure.

@openwork_ai  is the result of a short two-day hackathon our team decided to hack, which brings together some of our favorite open source AI modules into one powerful agent, to allow you to:

1. Bring your own model/API key (any provider and model supported by @opencode is supported by Openwork)

2. ~4x faster than Claude for Chrome/Cowork, and much more token-efficient, powered by dev-browser by @sawyerhood (legend)

3. More secure - contrary to Claude for Chrom/Cowork, does not leverage the main browser instance where you are logged into all services already. You login only to the services you need. This significantly reduces the risk of data loss in case of prompt injections, to which computer-use agents are highly exposed.

4. Free and 100% open-source!

You can download the DMG (macOS only for now) or fork the github repo via the link in bio (@openwork_ai).

Let us know what you think (or better, send a pull request)!

[Yuval Itzchakov @YuvalItzchakov]

@Cyburgerim בהחלט

[Yuval Itzchakov @YuvalItzchakov]

@gwenshap @shaiyallin שעה?

[Moav Vardi @MoavVardi]

המסביר האפקטיבי ביותר בנוגע להתגוננות האזרחים בעורף התגלה במקרה במהלך השידור מבת ים הבוקר.

[Yuval Itzchakov @YuvalItzchakov]

@Cyburgerim @LaviAlon 👑👑👑

[eric zakariasson @ericzakariasson]

we've been hard at work improving @cursor_ai Agent, allowing you to delegate more tasks and let it work alongside you

agent works just like a human developer, with access to your tools, codebase context, and the ability to take actions

here's what Agent can do ↓

[Hen Mazzig @HenMazzig]

Israeli actress Gal Gadot shares the news of the hostages’ release to her 108 million Instagram followers. 🎗️

[Guy Itzchakov @GuyItzchakov]

What fuels thriving relationships? #Responsiveness: #Listening, understanding, and supporting each other.
In our new chapter, Harry Reis and I present an integrated model of responsiveness and its powerful impact on #connection and well-being.
https://t.co/Q9whbPtNJ8

[Yuval Itzchakov @YuvalItzchakov]

@janekm @MattJamesBoyle @danielmelo_dm @JoseQues_ @MolloyLaurence @iavins You can use the new conditional-write feature in S3 precisely for this

https://t.co/ByWGPVjvMg

[Oren Ellenbogen @orenellenbogen]

It's BFCM time again! I wrote my book Leading Snowflakes for new Engineering Managers and it's now 50%-off for all packages https://t.co/8CCQrx1GEA

Please share if you got value in the past 11 years from https://t.co/Alau2bRbFY, https://t.co/liPNQBmMRP, https://t.co/KlTsnvhRBB and want to support my work and get free good karma for life.

[Lavi Goldshtein @LaviGoldshtein]

A new adware campaign, RoxiApp, is making waves with potential info-stealing capabilities.

Execution flow:
msi -> obs-ffmpeg-mux.exe
-> explorer.exe -> PowerShell -> malicous browser extension
⬇️ (1/4) IOCs below

[ימית מלול ינאי @YAMITYANAI1]

חברים יקרים

אני מבקש את עזרת כל אזרח בישראל או בעולם שיעזור לי לשתף את התמונה שבה שנראה עובד של אונר"א, ארגון שמועמד לקבל פרס נובל לשלום, כאשר הוא חוטף את הבן שלי לעזה.

בבקשה לשתף ולהעביר בקבוצות
תודה
קובי סמרנו

[Javier Milei @JMilei]

הלב שלנו שבוי בעזה
BRING THEM HOME NOW

[Yuval Itzchakov @YuvalItzchakov]

@avivby This.

[Barak Shine / 바락 샤인 / バラク・シャイン / 巴拉克 🇮🇱 @BarakShine]

The Korean people show their love and support for Israel today in downtown Seoul. More than 2000 people attended.

Thank you dear friends 🇮🇱🙏🇰🇷

오늘 서울의 중심에서 2천여 명의 한국 국민들께서 이스라엘에 대한 사랑과 지지를 보여주셨습니다. 감사합니다 🇮🇱🙏🇰🇷

[Geert Wilders @geertwilderspvv]

#BringThemHome
#AmIsraelChai

[Karim Sadjadpour @ksadjadpour]

1🧵 Iran and Israel are unnatural enemies. They have complimentary national interests (energy/technology), a historic cultural affinity (Persians/Jews), and no bilateral land or resource disputes. Their conflict is best understood through the prism of ideology, not geopolitics.

[Israel Defense Forces @IDF]

There are Olympic races that are longer than the distance between the Lebanese village of Kfarkela to the Israeli town of Metula.