Philipp Burckhardt

⚡Securing Software Supply Chains at @SocketSecurity ( Scientific computing for the web via @stdlibjs (

[Philipp Burckhardt @burckhap]

GraphMaker for easy graph building: describe in English what nodes and edges you want, and it handles the rest via OpenAI's help. Support for trees, DAGs, styling, saving in multiple formats etc. Work in progress, please send @CRGenovese and me feedback!

https://t.co/ThoIgCoo0Y

[Philipp Burckhardt @burckhap]

Overall very happy with the results. Much more dramatic lighting and lots of small improvements made over night, while not sacrificing any performance.

[Philipp Burckhardt @burckhap]

Giving Claude Fable 5.2 the night shift on #TheLastResident (https://t.co/9M8YzLKqXX)

Its job while I sleep: make the game look better.

Before and after comparison tomorrow evening.

[Feross @feross]

A malicious bee-js release hit npm with valid provenance and no npm token. The attackers used Ethersphere's own release bot.

With trusted publishing, the workflow is the credential. It should refuse any commit that isn't on a protected branch.

https://t.co/NtkuTZ3gKu

[Philipp Burckhardt @burckhap]

@jul1anodev @jul1anodev Will try to reproduce, sry. There are various graphics presets; ca add ?quality=very-low to the URL (or pick Very Low under Settings → Graphics on the title screen) and try "Learn to Play" again. Mind sharing how much RAM machine has?

[Philipp Burckhardt @burckhap]

I made a small, free FPS that runs in one's browser tab.

You're the last resident of an apartment block due for demolition at dawn. Rip chunks out of the walls with your mind and throw them at enemy robots.

Built on @babylonjs. Hosted on ChatGPT Sites, @OpenAIDevs.

[Feross @feross]

Two years ago, we took a team photo in Chicago.

This week, we came back and took another one. All 175 of us.

It was the most exciting moment since I started Socket. I've never felt energy like this.

We're hiring in every department: https://t.co/qdYAjWOx2O

[Philipp Burckhardt @burckhap]

@ArtemR @cursor_ai The extension was never compromised on Open VSX. See Socket’s write-up here: https://t.co/Wl6LDs4Fmx

[Socket @SocketSecurity]

🚨 A new GhostAction wave has hit hundreds of GitHub repos, including Uber’s athenadriver and Pyxel.
Attackers used compromised maintainer accounts to plant fake “security audit” workflows that steal GitHub Actions secrets.

[Philipp Burckhardt @burckhap]

@kellabyte I feel this so much, as well!

[Philipp Burckhardt @burckhap]

@elasticseclabs Shows that malicious packages can remain on package registries for months and that cooldown periods alone are not going to solve supply chain security. In this case, there is also `apexaccs/cli` (notice trailing s) and `apexscore/cli`, which share the same malicious code.

[Philipp Burckhardt @burckhap]

@PashaIGooD @threejs Not sure which game you are referring to, but the NYC in winter setting is maybe subconsciously influenced by Fahrenheit (Indigo Prophecy), which has a strong opening and which I enjoyed. Most direct inspiration here was car escape scene from Alone in the Dark (2008).

[Philipp Burckhardt @burckhap]

GPT-6 Astra is a beast with Blender. I decided to test its limits and tasked it with building me geometry that changes and deforms at runtime, rendered in @threejs . Not the highest-value use of a Sunday evening, but I ended up with a fun little disaster game demo (with sound)

[Philipp Burckhardt @burckhap]

@Drunkinho1 @threejs 8 million input tokens without cached input, roughly 800k output tokens.

[Philipp Burckhardt @burckhap]

@chenuka_j @threejs Yes, rendered with ThreeJS. Blender was used to generate all the assets in the scene, including the collapsing structures and their animations.

[Philipp Burckhardt @burckhap]

@threejs Was fun time play-testing and refining it over a few hours. Had Codex fix a few visual artifacts here and there, but the basic geometric transformations were basically done in one shot after I had it look up footage and how disaster movies handle this.

[Philipp Burckhardt @burckhap]

@threejs You can play the full game / tech demo here:
https://t.co/U8LPC3n1Mi

[Socket @SocketSecurity]

Maintaining critical software now comes with a security burden that has outgrown what any volunteer can reasonably carry.

That's why we're upgrading our open source program from the Team to the Business plan, full protection for maintainers at no cost.

https://t.co/rZvcSnehXF

[Socket @SocketSecurity]

🚨 Update: The jscrambler attacker published four more malicious releases: 8.16.0, 8.17.0, 8.18.0, and 8.20.0 with the same infostealer payload.

In 8.18.0 and 8.20.0, the dropper moved out of preinstall and into package code, bypassing npm install --ignore-scripts.

Jscrambler says an npm publishing credential was compromised. Upgrade to 8.22.0. We've updated our technical analysis.

[Philipp Burckhardt @burckhap]

More details on our blog, including recommended actions for defenders against yet another supply chain attack on the npm open-source ecosystem: https://t.co/hl3o0Ic5UY

[Philipp Burckhardt @burckhap]

Today, Socket detected malicious https://t.co/zs2xfdhboT npm packages that appear to replicate TeamPCP-style Canister Worm patterns, including exfiltration and self-propagation.