A note for the vibe coders:
If you're shipping with Claude Code or Cursor and you don't read your package.json carefully, you are the soft target this campaign was built for. AI-assisted development made it trivial to npm install your way into a working app in 30 minutes. It has done nothing to make you better at supply chain hygiene.
2. Pin your dependencies. No ^ or ~. @tanstack/* version against the Socket and StepSecurity advisories.
3. Start using minimumReleaseAge. Move off npm if you can and switch to pnpm v11 or Bun.
- The single most effective control right now is minimumReleaseAge: 1440 - your installer refuses to resolve any package published in the last 24 hours.
- This is a critical feature to stop supply chain attacks. This works because most affected packages are removed quickly by NPM, and a minimum age helps prevent installs of non-"battle-tested" packages.
4. Treat install-time scripts as code execution. Use pnpm's allowBuilds to whitelist exactly which packages get to run lifecycle hooks.
@MonetSupply@moo9000 It goes without saying that all AI generated code has rigorous human reviews. No one is vibe coding directly to production. We're increasing speed of shipping and innovation, while continuing to raise the bar on security.
🤖 👯 Introducing MD CRM: a markdown-based personal CRM, inspired by @karpathy's LLM Wiki
I'm in and out of meetings constantly, and I lose track of whom I met, what we talked about, and how it ties to everything else. @meetgranola is great for single events, but I needed something that stitched people, companies, and conversation threads together over time. Traditional CRMs are expensive, clunky, and built for sales teams, not for humans who just want to remember their network.
Then I came across Karpathy's LLM Wiki pattern and realised it was exactly the right substrate: a self-compiling graph of interlinked markdown. So I spent the last two weeks (on and off) building MD CRM on top of it.
I've been running it daily. I hook it up to my Hermes agent, forward it my Granola notes (or just type summaries from memory), and it compiles a structured wiki of people, companies, and conversations. Because it's just markdown, it lives inside my Obsidian vault — so the graph view, backlinks, and search come for free, and I can access it anywhere.
If you're running @NousResearch 's Hermes Agent:
⌨️ hermes skills install 0xbuooy/md-crm
and start typing notes.
If you're on @openclaw, setup is in the README.
Would love for folks to try it, break it, and tell me what's missing. Links to the github in the comments!
We’re updating our ChatGPT Pro and Plus subscriptions to better support the growing use of Codex.
We’re introducing a new $100/month Pro tier. This new tier offers 5x more Codex usage than Plus and is best for longer, high-effort Codex sessions.
In ChatGPT, this new Pro tier still offers access to all Pro features, including the exclusive Pro model and unlimited access to Instant and Thinking models.
To celebrate the launch, we’re increasing Codex usage for a limited time through May 31st so that Pro $100 subscribers get up to 10x usage of ChatGPT Plus on Codex to build your most ambitious ideas.
Exploring AutoAgent: an autonomous agent-engineering loop built around benchmark optimization.
A meta-agent edits the agent harness (prompting, tools, routing, orchestration), evaluates on Harbor tasks, and hill-climbs on score.
A very interesting direction for scalable agent iteration
Claude Code has a regex that detects "wtf", "ffs", "piece of shit", "fuck you", "this sucks" etc.
It doesn't change behavior...it just silently logs is_negative: true to analytics.
Anthropic is tracking how often you rage at your AI
Do with this information what you will