Daniele Cambi

Co-founder of App and Up Srl 👨‍💼 - I work and have fun on web, mobile and anything that involves code

[Daniele Cambi @dancamdev]

I’ve been working successfully with my extensions and widgets experiments for the past few weeks.

So I thought I share it with you and get new ideas and suggestions to improve it.

👉 Say hello to Xtended!

https://t.co/E3lo448yPM

[International Cyber Digest @IntCyberDigest]

🚨 How the TanStack npm attack actually happened:

1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.

[Drizzle ORM @DrizzleORM]

Drizzle v1.0.0-rc.1 is out 🚀

▪︎ Effect v4 native support
▪︎ JIT row mappers to reduce ORM overhead to ~0
▪︎ Reworked casing API (breaking change)
▪︎ Drizzle for LLM agents (preview)

Drizzle is now as fast as using raw driver and mapping(or not mapping) results by hand 🙃

[Vercel @vercel]

We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
https://t.co/0S939n3qHC

[Daniele Cambi @dancamdev]

@theo T3 chat is returning a 401 “OAuth token expired” even if Claude CLI is installed and logged in. Am I missing something?

[Daniele Cambi @dancamdev]

@ThomasBurkhartB It is indeed such a great name

[Daniele Cambi @dancamdev]

@Paul_ter_Laak @orcdev @convex Did you migrate from SQL? How did the migration look like?

[Daniele Cambi @dancamdev]

@orcdev @convex I’m skeptical, how much does it lock you on the platform? How does the data migration from and to convex look like?

[Adnan @adnansahinovich]

🛡️ React Native Security Rule #6 :

AsyncStorage is NOT secure storage.
If you save tokens, passwords, or credentials there, you’re storing them in plaintext. On rooted/jailbroken devices, attackers can dump it in seconds.

AsyncStorage is fully readable.
Treat it as public, not private.

Never store:
• auth tokens
• passwords
• API secrets

Use instead:
• expo-secure-store
• react-native-keychain
• native Keychain / Keystore

[Daniele Cambi @dancamdev]

@Baconbrix Looks great! Is that going to have an Android counterpart? Or is it gonna be iOS only?

[Daniele Cambi @dancamdev]

@Baconbrix @expo Where do I find a list of all available templates? I’d rather use those than refer to the nativewind docs that uses rn-new

[Daniele Cambi @dancamdev]

@ASalvadorini Now for the final test, is great grandchild barnbarnbarn?

[Daniele Cambi @dancamdev]

@tsapeta My guess? Llms.

[Daniele Cambi @dancamdev]

@filiphracek I loved this! Looks like we’re a few more than 2, thanks for sharing Filip

[Daniele Cambi @dancamdev]

@ASalvadorini @TahaTesser @Angaisb_ We’ve been doing progress, a steady 0.01% per year

[Daniele Cambi @dancamdev]

@ThomasBurkhartB Maybe they’re replaceable though

[Daniele Cambi @dancamdev]

@ThomasBurkhartB Same, this is one of the heavy aloy knobs, they feel super satisfying. Is the condensator thing causing noise? I get that from time to time

[Daniele Cambi @dancamdev]

@luke_pighetti I love this. Makes me wonder why I have t thought about it before, looks super clean

[Daniele Cambi @dancamdev]

@ThomasBurkhartB @pedromassangom I understand, it’s a crowded room with too little incentive to do well, especially financial one. Glad you could find a way to make it work