albertomiranda

Another web developer. Creator of and one incredible little kid :D

[Feross @feross]

North Korea is targeting npm maintainers -- not for crypto, but for write access to packages downloaded trillions of times a year.

Several Socket engineers were targeted in this campaign -- myself, @ljharb, @jdalton, and others. None of us fell for the bait. Unfortunately, the axios maintainer did. No shame in that -- these aren't phishing emails. They're weeks-long ops with fake companies, fake Slack workspaces, and spoofed meeting platforms built with realistic Zoom/Teams interfaces using the official SDKs for realism.

Other confirmed targets: @matteocollina (Fastify, Pino, Undici, Node.js TSC Chair), @wesleytodd (Express TC), @voxpelli (mocha, neostandard).

The common thread? High-trust maintainers with publish access to packages that sit deep in everyone's dependency tree.

The attack chain: build rapport over weeks, schedule a video call, fake an audio error, prompt the target to install a "fix." That fix is a RAT. Once it's on your machine, they have your .npmrc tokens, browser sessions, AWS creds, keychain. 2FA doesn't matter. OIDC publishing doesn't matter. Game over.

Security researcher @tayvano_ linked this to UNC1069, a DPRK-nexus group Mandiant has tracked since 2018. Why social engineer one rich person when you can compromise one maintainer and reach millions of machines?

This is the threat model now. If you maintain popular packages, act accordingly. If you use open source (and you certainly do), act accordingly.

Full writeup: https://t.co/bNKdrLmwMn

[albertomiranda @albertomiranda]

Having fun while learning how to create AI pipelines 😹
https://t.co/v9qAcpibWN

#AI #developerlife #development #software #art #CatsLover #CatsOnX #cats #Gatos

[albertomiranda @albertomiranda]

#fiestapixels #pixelsparty

[albertomiranda @albertomiranda]

#pixelsparty

[albertomiranda @albertomiranda]

#pixelsparty

[albertomiranda @albertomiranda]

🦙Playing with #Alpaca #LLaMA locally inside VSCode. Not really efficient, but a fun experiment 😁

https://t.co/Rcn8yaNqcl

[albertomiranda @albertomiranda]

☕️⚛ High on caffeine, currently implementing #ModuleFederation in #reactjs with dynamic imports.
❤️ Loving it!

[albertomiranda @albertomiranda]

@Novartis Someone in the supply chain is still removing Fingolimod from its original refrigerated package in the mid of our summer season. Today we had 37ºC! This is crazy and nobody seems to be able to solve the problem. Can you guys help?!

[albertomiranda @albertomiranda]

Hey @Novartis what's the proper way to transport #GILENYA pills during hot days? 35ºC and more. Does the package requires refrigeration even for trips no longer than 1 or 2 hours?

[albertomiranda @albertomiranda]

@Novartis Who can help us review how the supply chain is working? Do we need a #lawyer for this? We need to ensure the medication package reaches the patient in good condition, following the lab's requirements for transport & conservation. Please, we need help!

[albertomiranda @albertomiranda]

@Novartis This is really worrying... If the #Gilenya #fingolimod package is not stored following the lab's temp requirements, could this cause the medication to stop working as expected? If this is the case, this might already be affecting a lot of people in Argentina 😢

[albertomiranda @albertomiranda]

@Novartis The official response from Argentina's office matches the documentation: "Store GILENYA at room temperature between 68°F to 77°F (20°C to 25°C).", BUT... Somehow the medication still goes to the pharmacy without any cooling with +35ºC ambient temp! What can we do?

[albertomiranda @albertomiranda]

Awesome fake email server for testing 📨😎
https://t.co/OVMvCkbJ7J

[Feross @feross]

🚀 Exciting news! I'm ready to share the project I've been working on for the past 7 months!

Introducing ✨ Socket ✨

⚡️ Search millions of open source packages
🔒 Detect suspicious package updates in real-time
🛡 Block software supply chain attacks

https://t.co/NOyVIh3pNr

[albertomiranda @albertomiranda]

I was reviewing my collaborations to @WebTorrentApp and it feels so nice to have been able to contribute there! Nothing crazy, but we can still use those features today 😀

[albertomiranda @albertomiranda]

Another amazing project that has the potential to reshape the Internet 🌎
https://t.co/Paev4OPY97

[albertomiranda @albertomiranda]

#webamp + #IPFS experiment.
And some music I'm sharing with friends.
🌎🎵💻
https://t.co/EjQGgDWQ3g

[albertomiranda @albertomiranda]

You can find Webamp here:
https://t.co/NkeFBhZ87U

If you ever used Winamp you'll love it!

[albertomiranda @albertomiranda]

@elonmusk Next step: Solar crypto mining facility 😉
☀️⚡️🪙

[albertomiranda @albertomiranda]

@laguachafagaite Era otro Alberto Miranda LOL!