Charles Neill

Risky business

[Techiavellian @techiavellian]

https://t.co/b3IAq0GqUY

[Charles Neill @ccneill]

Reset the counter to 0 days since the last Python/JS supply chain attack...

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Charles Neill @ccneill]

Funny watching articles spread like wildfire on X now. You already know what article I'm talking about without me describing it at all

I can't decide if this is an algo artifact or if people are just using AI to summarize them now, speeding up their Time To Hot Take Reply

[Charles Neill @ccneill]

This is the gnarliest npm worm I've seen so far, and these will only get worse - appears this might still be in the testing phase

Persistence via git global config to poison future repos, CI jobs to grab new creds, even malicious MCP server injection

Amazing write-up - read!

[Socket @SocketSecurity]

🚨 Active supply chain attack

New Shai-Hulud–like npm worm (19+ packages, 2 aliases) stealing dev/CI secrets, injecting GitHub workflows, poisoning AI toolchains, and harvesting LLM API keys.

Details → https://t.co/ukQ2nVmzif #NodeJS #JavaScript

[Socket @SocketSecurity]

🚨 Active supply chain attack

New Shai-Hulud–like npm worm (19+ packages, 2 aliases) stealing dev/CI secrets, injecting GitHub workflows, poisoning AI toolchains, and harvesting LLM API keys.

Details → https://t.co/ukQ2nVmzif #NodeJS #JavaScript

[Charles Neill @ccneill]

"AI will let companies fire all the engineers."

Then who will dream up the unhinged video game programming environment that gets other engineers to lock in for 36 hours of straight prompting, HMM? 🤨

[near @nearcyan]

Announcing https://t.co/Te7kvitMfu - manage claude code in style!

New:
• Spatial Audio. Claude behind you? Claude on your left? No claublem!
• Animations: What's Claude up to? Watch him! ◕ ‿ ◕

Vibecraft uses your own local CC instances - no files or prompts are shared.

[Charles Neill @ccneill]

@AlexCaswen Importantly, though, I think it is a more meritocratic and open hierarchy than would occur with the groupchatification of everything

[Charles Neill @ccneill]

The ideal social media network for me would eliminate or significantly reduce the game of positioning yourself above others as if you were at the pinnacle of knowledge/skill in something

It would be built in - by virtue of you being here, you're on my level & we eschew the game

[Charles Neill @ccneill]

@AlexCaswen I actually don't mind the subtle reference to hierarchy, because the hierarchy is kinda the point. Otherwise it's just reddit

Gotta figure out how the staircase would work...

[Charles Neill @ccneill]

@AlexCaswen Silo has a negative connotation in tech, but in this case I think it's fairly accurate. The idea necessarily constrains scope so that popularity and other irrelevant factors don't overwhelm the value of one's contributions to a silo/level in the selection process

[Charles Neill @ccneill]

Happy new year, friends! Here's hoping we all avoid becoming part of the permanent underclass in 2026

[Charles Neill @ccneill]

Link here:

https://t.co/9aVlD1pXuI

[Charles Neill @ccneill]

I can already predict the critics' responses to @profplum99's latest piece: "SEE?! NOT $140K!"

And to those who actually read the piece, this will be just as irrelevant as their previous critiques

[Charles Neill @ccneill]

@Duderichy

[Charles Neill @ccneill]

Lol

H/T @Duderichy

[Charles Neill @ccneill]

@adamscrabble I'd potentially have >2k followers if I didn't block these. I'm curious about the ones that don't have any location data visible at all..

[Charles Neill @ccneill]

Looking through my block list, almost all the spam bots/fake accounts that follow me are from Hong Kong or Cambodia (I ~only block bots)

Seems like that should be easy to detect!

[Charles Neill @ccneill]

Looking through my block list, almost all the spam bots/fake accounts that follow me are from Hong Kong or Cambodia (I ~only block bots)

Seems like that should be easy to detect!

[Charles Neill @ccneill]

I've blocked enough of these stupid bots to almost double my follower count, but I am a man of virtue

[Charles Neill @ccneill]

Wonder how things have evolved at the bank regulators since this 2022 @Macro_Musings interview with @billnelson2x2

https://t.co/ecjcm6sNdB

[Barchart @Barchart]

BREAKING 🚨: Banks

New York Fed apparently held an emergency meeting with Wall Street Banks to discuss money market liquidity concerns 🤯😱👀

[Techiavellian @techiavellian]

He's baaaaaack

https://t.co/Na9hhL60rl

[Charles Neill @ccneill]

@cryptodavidw It seems to estimate based on what a human would say. I don't think LLMs have a good sense of time wrt their own capabilities

Friends have reported estimates of "weeks" that were knocked out in a couple hours

[Charles Neill @ccneill]

This was an excellent episode covering both cybersecurity and financial risks from an engineering perspective!

I'll save Patrick the algo hit and post the links:

https://t.co/FCVn1tVBZC

https://t.co/dFC63PsegS

https://t.co/9UJt83PKoW

[Patrick McKenzie @patio11]

This week for Complex Systems we're switching up the format a bit, since I was invited to give a talk at the Bank of England, on how a systems engineer thinks about systemic risk in a way that might be additive to central bankers. (All opinions in the talk are my own, etc etc.)