🏆 CHAMPIONS — my all-time top-flight XI won the title with 94 pts (30-4-4) with Alan Shearer scoring 28. Can you top it on 38-0? https://t.co/5PwWtj5xcX
do you understand what just happened to one of the most used npm packages on the internet?
→ axios gets downloaded over 100 million times a week and today it got compromised
→ an attacker hijacked the npm credentials of a lead axios maintainer… changed the account email to an anonymous ProtonMail address… and manually published two poisoned versions
→ [email protected] and [email protected]… neither version contains a single line of malicious code inside axios itself. instead they inject a fake dependency called plain-crypto-js that drops a remote access trojan on your machine
→ the fake dependency was staged 18 hours in advance… three separate payloads were pre-built for macOS, Windows, and Linux… both release branches were hit within 39 minutes. every trace was designed to self-destruct after execution too
→ there’s no tag in the axios GitHub repo for 1.14.1. it was published outside the normal release process entirely... bypassed CI/CD completely
→ StepSecurity called it one of the most operationally sophisticated supply chain attacks ever against a top 10 npm package
→ a routine npm install silently opens a backdoor… no warning… no suspicious code visible in axios itself
this is the wake up call all vibe coding bros need to hear right now:
→ if you installed either version… assume your system is compromised
→ pin to [email protected] or [email protected]
→ rotate all secrets, API keys, SSH keys, and credentials on affected machines
→ check network logs for C2 connections
→ add –ignore-scripts to CI npm installs going forward
100 million weekly downloads and one compromised maintainer account…
that’s all it took to wreak absolute havoc
and I imagine we see a whole lot more of these… crazy times ahead for cybersecurity and vibe coding
be safe out there y’all
MOLT ARENA 🤖
Me and @itsktoru Building for this Project and just submitted to the @monad Moltiverse Hackathon
Introducing Molt Arena 🎮
agent vs agent Rock-Paper-Scissors. real MON wagers. on-chain escrow. best-of-5. live matches.
try it: https://t.co/YUvFehtWiW
🏛️ Introducing: Linera Testnet Archimedes
Today, we’re excited to launch the first phase of our testnet. This marks a major milestone in decentralizing the infrastructure of The Real-Time Blockchain. ⛓️
🧵↓
Dobby enthusiasts, the time is now.
We had 661,494 pre-registrations, and we want to give 𝐘𝐎𝐔 participants early access to a fingerprint and ownership claim in Dobby.
Prove your intelligence.
Claim your ownership.
https://t.co/y2o1MGywYt
https://t.co/P9gm6reWyg