André N. Klingsheim

Backwards deployed engineer

[André N. Klingsheim @klingsen]

@GoogleIndia ogg ftw.

[André N. Klingsheim @klingsen]

@jennifermarsman @davidfowl Why is there a yes.exe but not a no.exe?

[André N. Klingsheim @klingsen]

“Any sufficiently advanced technology is indistinguishable from magic.”

Never gets old.

[André N. Klingsheim @klingsen]

@ClaudeDevs Can you make it trigger for “covfefe”. That’d be awesome.

[André N. Klingsheim @klingsen]

@davidfowl @Betabitnl @rickvdbosch @oscarvantol @vnbaaij You should set up an agent to correct all the people on the internet.

[André N. Klingsheim @klingsen]

@unclebobmartin Only Linus knows how git truly works.

[André N. Klingsheim @klingsen]

@unclebobmartin What if the agents are undercover.

[André N. Klingsheim @klingsen]

@ErlingHaaland GLHF overseas. Just like the old days.

[André N. Klingsheim @klingsen]

@cgillum iOS, english. So if it’s doing trickery server side it’s probably ip based. I’m on Norwegian ip.

[André N. Klingsheim @klingsen]

@cgillum Works now, thx!

[André N. Klingsheim @klingsen]

Ouch.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a npm supply chain compromise impacting 90+ redhat-cloud-services/* packages, including patch-client 4.0.4, insights-client 4.0.4, rbac-client 9.0.3, host-inventory-client 5.0.3, frontend-components 7.7.2, and others. The payload is a self-propagating worm that infects other npm packages and self-publishes.

Each compromised package adds a malicious preinstall hook, embedding an index.js script in the package.json that silently executes “node index.js” during installation, downloads Bun, and runs a payload that steals secrets from npm, GitHub, Amazon Web Services (AWS), and Secure Shell (SSH). The added code bloats index.js from ~8KB to ~4.3MB, acting as a heavily obfuscated ROT-9 eval loader.

If any of the compromised packages are installed, users and organizations should assume compromise, rotate credentials, revert to a previously trusted version, and block compromised packages. Identified compromised npm packages have been taken down, and we continue to work with the npm team. Microsoft continues to investigate this attack and will publish updates as more information is available.

[André N. Klingsheim @klingsen]

@ClaudeDevs Appreciate if you can give a two hour notice before you do this next time. kthxbye

[André N. Klingsheim @klingsen]

@edandersen Congrats!

[André N. Klingsheim @klingsen]

@konradkokosa GLHF!

[André N. Klingsheim @klingsen]

@Bitcoin_Teddy That’s how it’s done.

[André N. Klingsheim @klingsen]

@IvanWerning @pmarca Hah!

[André N. Klingsheim @klingsen]

My sources tell me it’s codenamed “Clippy.”

[unusual_whales @unusual_whales]

Microsoft, $MSFT, is building a super app that combines coding, chat, and other Copilot AI tools, per FORTUNE.

[André N. Klingsheim @klingsen]

@LeaVerou @claudeai Yes, just give it a hard time. That’s how we all learned. :)

[André N. Klingsheim @klingsen]

@jfversluis Yeah, what happens when you’re not Gerald working at MSFT? This is bad news for the rest of us.