𝖆𝖕

SWE (Backend-focused)🔸
12+ years building apps remotely🔸

blog:

[𝖆𝖕 @asispts]

Created a dedicated page for my VS Code extensions. Let’s see if this helps with domain verification.

https://t.co/nzp5WTIYeT

[𝖆𝖕 @asispts]

Gila sih, tiada hari tanpa npm issues.

[Socket @SocketSecurity]

🚨 Active supply chain attack: A mini Shai-Hulud campaign hit npm packages under the @​redhat-cloud-services namespace.

The compromised packages execute install-time malware to harvest developer and CI/CD secrets, with encrypted exfiltration and GitHub-based fallback mechanisms.

[𝖆𝖕 @asispts]

Konsep error handling di rust benar2 bagus, sangat explicit... 🫡

[𝖆𝖕 @asispts]

Dengan adanya AI, kepakaran emang benar2 hilang. Tanda akhir zaman juga sih.

Good policy 🫡

[Oxana Mazurchak @OxanaMazurchak]

really cool to see @ThePrimeagen react to our Andrew Kelley / Zig interview live and say the Zig’s no-AI policy finally makes sense to him after hearing Andrew explain it.

as the showrunner for this episode couldn't be happier to see this reaction!

[𝖆𝖕 @asispts]

Semakin yakin ngga akan pernah ngoding tanpa devcontainer

[Socket @SocketSecurity]

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.​io.

Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems.

TrapDoor targets #crypto, #DeFi, AI, and security developers, stealing wallets, SSH keys, cloud credentials, GitHub tokens, browser data, env vars, and API keys.

Socket detected releases with a median detection time of 5 minutes, 27 seconds. The fastest detection occurred 58 seconds after publication.

[𝖆𝖕 @asispts]

@GregorySchier I'm not sure. gnome-screenshot and scrot already seem pretty good to me.

[𝖆𝖕 @asispts]

What the .... Lama2 saya fork juga nih repo🤦‍♂️. Ngga semua org pake bullshit desktop/web app

[dax @thdxr]

one pattern we could do is the first time you run opencode it forks into the background as a server

then every other time you launch it or use the webapp or desktop app they all use that one instance so everything is synced

i'm worried this feels unexpected to people though

[𝖆𝖕 @asispts]

This is why I still use devcontainers for local dev. At least compromised packages don’t get direct access to my host system.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[𝖆𝖕 @asispts]

@SocketSecurity What???

[𝖆𝖕 @asispts]

@saltyAom Instead of passing plugins around, can we just add the plugin type (datatype) to the Elysia instance, since the plugin is already included in the parent instance? The children only need to know about the injected context.

[𝖆𝖕 @asispts]

@yusukebe Wow, will try it 👍

[𝖆𝖕 @asispts]

@opencode Should I report this? But I'm not sure how to reproduce it

[𝖆𝖕 @asispts]

Finally, after a lot of trial-and-error, I got agent-browser working in a devcontainer with an efficient setup and a better viewport.

[𝖆𝖕 @asispts]

Currently rewriting my @tan_stack start app to @inertiajs with @vuejs . I really like it so far. For heavy backend business logic, inertia seems like a better fit than both tanstack start or @nextjs

[Yusuke Wada @yusukebe]

Inertia.jsよさそうなので、Honoで使うexample作ってみた。よくうごく
https://t.co/r2nQENUGy8
#rubykaigi

[𝖆𝖕 @asispts]

@Alibaba_Qwen 3.6 is really good. I finally have an Opus/Sonnet alternative for UI work.

[𝖆𝖕 @asispts]

@ekawicaksana Emang kacau sih. Mari fokus kerja remote aja

[𝖆𝖕 @asispts]

@FabianHiller So, Formisch is actually what I need 👍

[𝖆𝖕 @asispts]

v0.4.0 is here! 🚀

• Full localization support (EN + ZH) 🇨🇳
• Security fix + minor improvements

https://t.co/g0Ty3Y4pMQ

[𝖆𝖕 @asispts]

(neo) Git Graph v0.3.0 is out! 🚀

- Git client now powered by simple-git
- New "locate HEAD" button
- Cleanup & improvements

Clean MIT fork of Git Graph for VS Code

https://t.co/aGQAUYItAg

[𝖆𝖕 @asispts]

Next release of neo-git-graph adds Chinese support! 🇨🇳

https://t.co/LyZdCqPkyg

[𝖆𝖕 @asispts]

@RhysSullivan I use @elysiaJS to serve both backend and reactjs frontend in a single dockerfile

[𝖆𝖕 @asispts]

@saltyAom My only concern is that the same plugin must be included in every Elysia instance (child instance) that uses it.