Doprax

Easy and safe #CloudPlatform here to help developers #deploy their projects in a matter of seconds!

[Doprax @doprax]

Doprax v2 is here.

New infrastructure. New billing. New container platform. Expanded VM catalogue. GPU options. Better everything under the hood.

And for existing users: we're wiping the slate clean! General amnesty on all old billing issues & debt when you migrate.

New system. Fresh start.

More details dropping soon.

[Doprax @doprax]

Hetzner is increasing their prices starting June 15. They’ve not published any numbers yet. Keep an eye on your Doprax dashboard, and we’ll bring you the latest news when we have them.

What’s going on & what you should do before June 15: https://t.co/smNWlRcNJj

[Doprax @doprax]

In many cases having the “best” VPN (like VLESS + REALITY) won’t save you from being flagged or blocked. Which means the real skill is flexibility: portable config, more than one node, a clean IP you can spin up in under a minute.

Full breakdown, plus what a resilient setup actually looks like:

[Daniel Lockyer @DanielLockyer]

Hetzner server prices are going up again in June ☹️

[GitHub @github]

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

[Doprax @doprax]

This is fun

[Doprax @doprax]

𝗻𝗽𝗺 𝘀𝘂𝗽𝗽𝗹𝘆-𝗰𝗵𝗮𝗶𝗻 𝘄𝗼𝗿𝗺 𝗵𝗶𝘁𝘀 𝟭𝟲𝟵+ 𝗽𝗮𝗰𝗸𝗮𝗴𝗲𝘀. 𝗛𝗲𝗿𝗲'𝘀 𝘄𝗵𝗮𝘁 𝗗𝗼𝗽𝗿𝗮𝘅 𝘂𝘀𝗲𝗿𝘀 𝗻𝗲𝗲𝗱 𝘁𝗼 𝗱𝗼.

Yesterday the Mini Shai-Hulud worm (attributed to TeamPCP) compromised TanStack Router, UiPath SDKs, Mistral AI's TypeScript client, Guardrails AI, and 165+ other npm packages. 373 malicious versions total.

The worm hijacks CI/CD pipelines via GitHub Actions cache poisoning, steals credentials, and installs a persistent daemon. The daemon polls GitHub every 60 seconds. If it detects a revoked token, it runs rm -rf ~/ on the host. So the cleanup order matters.

If you run Node.js on a Doprax VM:

1. Check: npm ls | grep -E '@tanstack|@uipath|@mistralai|guardrails'
2. Run npm audit
3. If you find anything, stop gh-token-monitor BEFORE rotating tokens
4. Wipe node_modules, reinstall with --ignore-scripts
5. Rotate all credentials that touched the VM

A note on prevention: pnpm 11 ships with minimumReleaseAge: 1440 (24-hour cooldown), blockExoticSubdeps, and no-install-scripts as defaults. Three of this attack's main mechanisms blocked out of the box. If you've been meaning to try pnpm, this is the moment.

Our isolated VMs mean the blast radius stops at one machine. Core Doprax is unaffected.

Full guide with commands: https://t.co/zftoDDGMN2

[Doprax @doprax]

Did you know that you can easily create a Doprax app for your phone? Useful if you want to check in on your deployments every now and then.

🍏 For iPhone (Safari):
• Open Safari and go to https://t.co/khb0aezi4a.
• Tap the Share icon (the square with an up arrow at the bottom).
• Scroll down and select "Add to Home Screen."
• Name it "Doprax" and tap Add.

🤖 For Android (Chrome):
• Open Chrome and head to https://t.co/khb0aezi4a.
• Tap the three dots (⋮) in the top right corner.
• Select "Install app" or "Add to Home screen."
• Confirm by tapping Install/Add.

[Doprax @doprax]

We’re now offering Google Cloud!

Which means: you can have the power of one of the largest fiber networks in the world, but without the complexity. Deploy AI agents, scale up as high as you want, be local everywhere (43 new locations).

Request early access via the Doprax dashboard:
https://t.co/KYpcunTKoA

[Doprax @doprax]

The 4 Tiers of VPNs:

🟢 Tier 1 — Easy to identify
WireGuard, OpenVPN/UDP, IKEv2, L2TP. Fast and simple, but have clear packet signatures. Fine on most networks, first to get filtered where traffic gets inspected.

🟡 Tier 2 — TLS-wrapped, still fingerprintable
OpenVPN/TCP, SOCKS proxies. Looks like HTTPS at a glance, but the handshakes have quirks that distinguish them from real browsers.

🟠 Tier 3 — Camouflaged as web traffic
Shadowsocks, OpenConnect, OpenVPN+XOR, SoftEther. Blends in well against simple inspection. More advanced detection (entropy analysis, active probing) can still spot them.

🔴 Tier 4 — Indistinguishable from web traffic
v2ray, VLESS, wstunnel, Cloak. Not VPNs themselves — mimicry layers you bolt onto a tunnel. Cloak even serves a real "donor" website to anyone probing your server 🎭

The takeaway: run more than one. WireGuard for speed, a Tier 3/4 stack as a fallback.

Read more 👉 https://t.co/NRembTA5JV

[Doprax @doprax]

Do you need to run your own VPN for any reason? Here’s how you can easily run @AmneziaVPN via a Doprax VM:

https://t.co/BeDKcExTV5

TLDR: all you need to do is create a VM, grab its credentials, and enter them into your Amnezia app (port 22).

[Doprax @doprax]

https://t.co/UL4TpskCja

[Doprax @doprax]

@yulia_navalnaya @Apple So let's create a workaround then.

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Doprax @doprax]

The “Great Repatriation” and the “Sovereign Stack”

Around 2023/2024 companies started realizing that hosting their stuff on big names like AWS or Google is getting expensive.

That’s how the "Great Repatriation" began.

We can compare cloud giants like AWS to a hotel. Very convenient, because someone else handled the cleaning, the plumbing, and the security.

But the hotel slowly raised its rates. They started charging for every person you brought into your room (per-seat pricing) and every time you carried a bag through the lobby (egress fees).

Eventually, the hotel bills became higher than a mortgage.

People started moving out of those high-prices hotels, and moving into their own homes.

You don’t have to keep renting a hotel room.

𝗧𝗵𝗲 "𝗦𝗼𝘃𝗲𝗿𝗲𝗶𝗴𝗻 𝗦𝘁𝗮𝗰𝗸" is the act of building your own house on your own land. Or, if you don’t want to buy a piece of land, you can always park your tiny home on our soil ;)

[God of Prompt @godofprompt]

🚨 BREAKING: Someone just open-sourced a full offline survival computer with AI, Wikipedia, and maps built in.

Project N.O.M.A.D. is an open-source offline survival computer.

Self-contained.
Zero internet required after install.
Zero telemetry. Everything runs locally on your hardware.

What it includes:
→ Full Wikipedia archives via Kiwix
→ Offline maps via OpenStreetMap
→ Local AI models via Ollama + Open WebUI
→ Calculators, reference tools, resource libraries
→ A management UI to control
everything from a browser

One curl command installs the entire system on any Debian-based machine.

Runs headless as a server so any device on your local network can access it.
Minimum specs to run the base system: dual-core processor, 4GB RAM, 5GB storage.

To run local LLMs offline, you want 32GB RAM and an NVIDIA RTX 3060 or better.

No accounts.
No authentication by default.
No cloud dependency.
No phone-home behavior.

Built to function when nothing else does.

The grid, the cloud, the API you depend on. None of it is guaranteed.

The people building local-first systems right now are the ones who won’t be asking for help when access disappears.

[Doprax @doprax]

@paulo_kombucha Cute af!

[Cyber_Racheal @CyberRacheal]

Chmod 700. Add yours

[Doprax @doprax]

https://t.co/S7CFXfB4fU