John Koster

the Blade guy. building

[Aikido Security @AikidoSecurity]

Aikido's malware feed is now built into Composer 2.10, https://t.co/Q20jobCH09's latest release. 🐘 Malware will be blocked at install time automatically, keeping PHP developers safe.

Supply chain attacks on PHP packages are rising. Just weeks ago, attackers hijacked laravel-lang and intercom/intercom-php through stolen credentials to push malicious releases. The new update prevents users from installing malicious or compromised packages like these.

Make sure to update your Composer to get built-in supply chain security!

[John Koster @johnmkoster]

@willking This getting noted is 🤌😂

[John Koster @johnmkoster]

its alive! back to what i was doing before #statamic

[John Koster @johnmkoster]

databases for speed and performance
filesystem for awesome flexibility and the best sync/publishing story

i want both. so here i go.😮‍💨

[John Koster @johnmkoster]

databases for speed and performance
filesystem for awesome flexibility and the best sync/publishing story

i want both. so here i go.😮‍💨

[John Koster @johnmkoster]

@jeffrey_way That was 🔥

[John Koster @johnmkoster]

@aarondfrancis Absolutely wild. The amount of restraint exercised when replying to some things 😅

[Filament 🦒 @filamentphp]

Attention Filament users: we’ve identified and resolved a few security vulnerabilities.

To address these vulnerabilities in your applications, please update to the following versions:

v3.3.52
v4.11.5
v5.6.5

[John Koster @johnmkoster]

Happy Saturday, everyone! I hope you all have a great weekend 😊

[John Koster @johnmkoster]

@MattParkerDev @davidfowl Oh I like this

[John Koster @johnmkoster]

@aarondfrancis Oh heck yes. A side project idea I don’t have to do 🔥🔥

[TANSTACK @tan_stack]

After a very thorough 3 day full security sweep and hardening process, we'd like to issue an official all clear ✅ on TanStack repo and package security. Full details have been updated in our post-mortem and security followup blog (linked below).

TL;DR:

- Only the Router/Start repo was affected. 42 monorepo packages, 2 versions per package. These were promptly deprecated within the hour and removed by NPM shortly after

- All other repos and packages were unaffected and remain secure including: Query, DB, Store, AI, Table, Form, HotKeys, Virtual, Pacer, Config, Devtools, CLI, Intent, etc.

- All available and published versions of every TanStack package are safe to download, including TanStack Router/Start.

https://t.co/KQSXhUM4XM
https://t.co/mtN9hF5Ioy

[John Koster @johnmkoster]

@jesseleite85 @savvycal Clean 🔥

[John Koster @johnmkoster]

@aarondfrancis Hey now, that’s a secret!

[John Koster @johnmkoster]

@jeffrey_way Yup, I do enjoy this style of AI-assisted dev! Maximize the fun

[John Koster @johnmkoster]

@simonhamp Looks sick

[John Koster @johnmkoster]

@IanLandsman

[John Koster @johnmkoster]

This looks awesome

[Ashley Hindle @ashleyhindle]

Just released the best websocket tester / playground 🤩

- 100% free, web-based
- Relay server lets you set custom HTTP headers
- Echo server built-in
- Save workspaces, custom messages, reconnect & heartbeat settings

Need to test websockets? Do it here: https://t.co/B0XsrYWleG

[Low Level @LowLevelTweets]

nah im just not gonna run npm install anymore

[John Koster @johnmkoster]

@jasonlbeggs @aarondfrancis It just might

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.