mehul

Developer | Designer | Product Manager (Working) | Baker

WIP

[mehul @codemehs]

After 4 weeks from launching, https://t.co/Uvc9zagOpG touched 250 users today. and 350+ upvote
Have been receiving great feedback from users.

Nothing feels better than some market validation. Smiling face with smiling eyes

[Evan Luthra @EvanLuthra]

🚨A HACKER GROUP JUST STOLE 4,000 OF GITHUB'S OWN PRIVATE REPOSITORIES.. PUT THEM UP FOR SALE FOR $50,000.. AND THE WAY THEY GOT IN IS THE SCARIEST PART..

They didn't hack GitHub's servers.. They poisoned a VS Code extension.. One GitHub employee installed it.. And the attackers walked through the front door using the employee's own credentials..

The group calls themselves TeamPCP.. They name their malware after the sandworms from Dune.. And they've been running the most sophisticated supply chain attack campaign in cybersecurity history..

Here's how the whole thing unfolded..

In March.. They poisoned Trivy.. One of the most trusted security scanners in the world.. Used by over 10,000 development workflows globally..

They injected credential-stealing malware into Trivy's official GitHub Action.. The malware ran silently BEFORE the security scan.. So every log showed "scan completed successfully" while the malware was stealing AWS keys, SSH credentials, database passwords, and Kubernetes tokens in the background..

It took Aqua Security 5 days to fully remove them..

Using the stolen credentials.. They breached Cisco Systems.. Cloned over 300 private repositories.. Including source code for unreleased AI products.. And repositories belonging to Cisco's customers.. Major banks.. Government agencies.. BPO firms..

In April.. They hit Checkmarx.. Another security vendor.. Poisoned 5 official Docker images in 83 minutes.. The scanner worked perfectly.. It just silently sent all your secrets to the attackers..

That automatically cascaded into Bitwarden.. The password manager.. Their CI/CD system pulled the poisoned Docker image.. And the attackers injected malware into Bitwarden's official CLI package published on npm..

One compromised security scanner poisoned a password manager.. Automatically.. No human involved..

In May.. They hit TanStack.. Libraries downloaded millions of times per week.. 84 malicious package versions across 42 packages..

And here's the terrifying part..

The malware scraped the raw memory of GitHub's build servers.. Extracted authentication tokens.. Used those tokens to bypass two-factor authentication.. And then published the infected packages with completely valid cryptographic signatures..

Every security verification tool on earth said the packages were legitimate.. Because they were signed by the real pipeline.. Using real keys.. The attackers just happened to be inside the pipeline when it signed..

They defeated the entire trust model of modern software supply chains..

The same week they hit the Nx Console VS Code extension.. 2.2 million installations.. The malware specifically targeted Claude Code configurations.. Hunting for AI assistant credentials..

That's a first.. Supply chain malware designed to steal your AI's access keys..

Then on May 19.. They revealed the GitHub breach.. 4,000 internal repositories.. Listed for sale at $50,000.. With a warning.. "If nobody buys it.. We leak everything for free"..

Their malware is self-propagating.. Once it infects one package.. It automatically finds every other package that developer maintains.. Steals the publish tokens.. And infects all of them.. Then those packages infect the next developer.. And the next..

It jumps between npm and PyPI automatically..
The group doesn't even do the extortion themselves.. They sell stolen credentials to ransomware gangs.. One gang used TeamPCP's data to threaten Cisco with leaking FBI and NASA personnel records..

And the scariest part of all..

They didn't break any encryption.. They didn't find any zero-days.. They exploited the fact that the entire software industry blindly trusts its own build tools..

Every security scanner.. Every Docker image.. Every VS Code extension.. Every GitHub Action.. Is a potential weapon if someone poisons it upstream..

And right now.. Nobody can tell the difference between a legitimate build and a compromised one..

Because the compromised ones have valid signatures too.

[Finn Mallery @fin465]

talked to a bunch of current YC batch founders today

The ones hitting $1m+ ARR (there are several this batch) are just ripping the same outbound playbook every time:

1. build your lead lists using tools like Origami or Clay
2. Run an auto-connect + DM sequencer on LinkedIn
3. aim for 200 connects/week. linkedin is a goldmine
4. when writing Linkedin DMs, send 2-sentences, ideally with a warm thread (shared school, mutual, etc)
5. Post on LinkedIn 5x/wk minimum
6. get good at AEO (yes, you can get results in a few weeks )

Spend 20 hrs/wk doing this properly, and you will start consistently booking demos

[Multimodal @MultimodalAI]

These guys are geniuses.

They raised $61M for their AI startup that automates customer support.

Companies like DoorDash use their AI to supercharge customer experience. Here's why:

• Self-Improving Agent: their AI agents go from 60% to 98% resolution automatically

• Fast Time-to-Value: go live in less than 2 weeks, compared to months

• World-class Voice Experience: ultra-low latency and across 99 languages

We have the same mission - automate workflows for companies.

AgentFlow by Multimodal takes it even further.

You can build AI agents that automate entire workflows in insurance and finance.

Create, deploy, and coach agents through an intuitive interface - no coding required.

This is how we ride the AI wave.

[- Elijah Muraoka - @elijahmuraoka_]

My Uber driver just reviewed and merged a PR while driving

I swear this shit only happens in SF

[Jack Morris @jxmnop]

curious about the training data of OpenAI's new gpt-oss models? i was too.

so i generated 10M examples from gpt-oss-20b, ran some analysis, and the results were... pretty bizarre

time for a deep dive 🧵

[mehul @codemehs]

@JCKHLRY need it

[ア @yuruyurau]

a=(x,y,d=mag(k=(4+sin(y*2-t)*3)*cos(x/29),e=y/8-13))=>point((q=3*sin(k*2)+.3/k+sin(y/25)*k*(9+4*sin(e*9-d*3+t*2)))+30*cos(c=d-t)+200,q*sin(c)+d*39-220)
t=0,draw=$=>{t||createCanvas(w=400,w);background(9).stroke(w,96);for(t+=PI/240,i=1e4;i--;)a(i,i/235)}//#つぶやきProcessing

[Aurelien @Aurelien_Gz]

what a beautifully over engineered typewriter…

[mehul @codemehs]

@benln Looks like I am building in the right direction

https://t.co/P2643GMF9u

[mehul @codemehs]

@benln noice....

[Wild content @Nocapmedia]

This video will always be wild to me

[Reads with Ravi @readswithravi]

“You escape competition through authenticity.” - @naval

Remind yourself this everyday.

[Jacob Bank @jebank]

Our marketing team is just me and ~40 AI agents.

I finally got around to putting them into an "org chart", and it's actually really cool to see!

Plus, laying them out this way by sub-function (social media, blog, email, community, partners, etc) has given me a bunch of ideas of other agents I want to build.

If you're interested in the full version (and the templates/screenshots for each agent), let me know and I'll send it over to you.

[Garry Tan @garrytan]

In AI, we need to be building brand new cars instead of horseless carriages

[mehul @codemehs]

@pfista with subtitle

[mehul @codemehs]

@pfista prompt :
An influencer in a black t-shirt stands in front of a dramatic Star Wars scene, the Jedi Purge begins, and Clone Troopers turn on their Jedi generals.
Cinematic lighting, subtle sci-fi background, influencer calmly unboxing and showing a new hair dryer.

[mehul @codemehs]

OpenAI published a 24-page masterclass on AI adoption

https://t.co/21VzYK8M6k

[Founder Mode @Founder_Mode_]

Patrick Collison (CEO, Stripe) — How to Move Fast

[Garry Tan @garrytan]

The sweet sweet moment you find product market fit (wait for it)

[LlamaIndex 🦙 @llama_index]

In this video from @KaranVaidya6, watch GPT-4o generate Tetris in one shot using LlamaIndex and @composio!

Check out the code here:
https://t.co/KJb7YRINWg