MarE (xk)

Art.Ⓜ️NOStyl @PowerDada👣 NY, London, Zúrich, Barcelona, Lisboa, Seoul ,Tarragona,🌱15th Havana Biennale, Valparaíso & ++ ... now Deepmountain...💭

[DADA @PowerDada]

Who's going to Art Basel this year? @dadacreeps, that's who. We are proud to be included in @artmetaofficial's landmark survey of 70 years of Digital Masterpieces. Read more below: 1/2

[ilan katin @ilan_katin]

My mother was an illustrator and graphic novelist. Am preparing the archive of her work now for inclusion by @Columbia University Library. Two frames, a child (my mother) and her mother's wisdom. #learntolove. It's worth it. For everyone.

[Mlibty @mlibty]

MLIBTY Shadows 7-day plan for this space

Paper, digital image, acrylic, and ink on skated board

[MarE (xk) @marespi]

@yonatvaks @ori_goldberg 🥰🫂

[BaityBait @BaityBait]

Al de la Filmoteca Maldita, que subía películas Lost Media, le piden 2 años y medio de cárcel y 870k€

Mientras él esperaba su juicio, varias empresas piratearon terabytes de libros para entrenar sus IAs

El copyright NO protege la cultura ni es igual para todos

Hoy hablamos de eso

🔗 https://t.co/xO3LT4nGbZ

[return() @returndotart]

Still Here marks the first exhibition by return(), presenting digital artworks that affirm a simple truth: despite displacement, loss, and ongoing attempts to erase them, the Palestinian people are still here.

The exhibition features works from the @FlyingBeagle_ collection and includes 23 artists from 15 different countries.

📅 June 4 – 16 🕛 12 PM – 8 PM
📍 Palacete Gomes Freire | Rua Gomes Freire 98 1150 - 179 Lisbon, Portugal

Admission is free. Everyone is welcome.

Follow return() for exhibition updates and to learn more about featured artists and the stories behind their works.

[ij8 @ij8_labs]

To learn more about https://t.co/AGxt1R9Xxc, explore the platform through two connected spaces:

Classroom — for instructors teaching AI literacy, creative computing, and computational imagination.
https://t.co/Zn9uRwep91

Tooling — for creators building with AI across image, code, 3D, motion, and story.
https://t.co/jaeWeF1pfy

[die with the most likes @toadswiback]

there will come a day in which artists won’t share creations because the prospect of a model speed running their work into a costco end-cap impersonation is just too exhausting.

many ideas are too cherished for that type of destruction.

in that isolation will be freedom.

[🥤 Max ༒ Osiris 🔥 ௐ³⁶⁹ 🎩 maxosiris.eth 𑖭𑖰𑖟𑖿 @maxOSIRISart]

Raw Deal
1/1 on SR ...

[Feross @feross]

🚨 node-ipc is compromised again.

Three new malicious versions just dropped: 9.1.6, 9.2.3, and 12.0.1. Socket’s AI scanner flagged them as malware within three minutes of publication.

The attack vector: a dormant maintainer account (atiertant) was likely taken over via an expired email domain. The attacker registered the lapsed domain, triggered an npm password reset, and gained publish rights to a package with millions of historical downloads.

The payload is a credential stealer embedded in the CommonJS entrypoint (node-ipc.cjs). It activates on require(“node-ipc”), not through a postinstall script. Here’s what it does:

•Fingerprints the host (OS, arch, hostname, uname)
•Harvests 113-127 credential file patterns depending on platform (AWS, GCP, Azure, SSH keys, Kubernetes configs, npm tokens, .env files, shell histories, macOS Keychain databases, and more)
•Dumps the entire process.env, capturing every CI secret and cloud credential in memory
•Builds a gzip archive in a temp directory
•Exfiltrates everything over DNS TXT queries to bt[.]node[.]js, using a bootstrap resolver at sh[.]azurestaticprovider[.]net:443 (a deliberate lookalike of Microsoft’s Azure Static Web Apps domain)

The DNS exfiltration is chunked. A 500 KB archive generates roughly 29,400 TXT queries. The body is XOR-encrypted with a SHA-256 keystream, base64-encoded, alphabet-substituted, and split into 31-character chunks before hex-encoding into DNS labels. Header, data, and footer queries use xh, xd, and xf prefixes respectively.

The malware forks a detached child process (env var __ntw=1) so credential theft runs silently in the background. It also exposes a __ntRun export, meaning any downstream code that calls require(“node-ipc”).__ntRun() can trigger a second collection/exfiltration cycle.

ESM-only consumers using the import path are not affected by the reviewed package metadata. CommonJS consumers are.

This is the same package involved in the 2022 protestware incident. It has a history.

If you use node-ipc:

•Do not install 9.1.6, 9.2.3, or 12.0.1
•Audit your lockfiles for these versions
•If you loaded the CommonJS entrypoint, treat all environment variables, SSH keys, cloud credentials, npm tokens, and local secrets as compromised. Rotate immediately.
•Hunt for DNS TXT queries to bt[.]node[.]js and sh[.]azurestaticprovider[.]net in your network logs
•Check for temp files matching <tmp>/nt-<pid>/<machineHex>.tar.gz

Credit to Ian Ahl (@TekDefense) for first publicly identifying the expired-domain account takeover vector.

Developing story. Full technical breakdown and IOCs on the Socket blog: https://t.co/InMKQUO9kB

[luluxxx @luluixixix]

m(aa)rche. luluxxx
Minted Nov 4, 2021 ~ 500 editions

[Bittty ⚡ @bitttygordon]

Genesis mint, YETI SPAM, ERC-721contract :

Moonie
8534 x 8534 px, 22.2 mb
JPG

SOLD

YETI SPAM or SPAM YETI is a multichain, Ai-assisted Spam Art project born in 2023. Imaginings of the elusive cryptid, the yeti of Tibetan folklore, are manifest as potential albeit unlikely physical beings in response to the ongoing Yeti Cooler gmail spam campaign. The yeti is believed to be feared, as a ferocious rectifier of human disregard for the natural world. These 'dubious' offerings to the spammed suggest a rethinking of the boundaries of science & technology vs the mythical, magical & creative

https://t.co/AWAECAXS6H

[ANgiE tAYLoR 🧷 🧷 🧷 @theAngieTaylor]

GET YOUR SHIRT! ❤️🧷🧷❤️

[L'bank | 🐉 @Lbank_]

I want to create a new curation on @objktcom ✨

I'll start by adding collections from my favorite collectors to get the first steps going.

So if you're a #Tez artist - please don’t be shy and share your art below!

Also, I’d love it if you could repost this 🫶

[History of Bitcoin - Smashtoshi @bysmashtoshi]

Happy Proof of Keys Day! 🔑

We look back at how this tradition started and why self-custody remains the ultimate test of ownership.

Insights from @TraceMayer, @nvk, and @CaitlinLong_ on why “Not your keys, not your coins” is more than just a slogan. 🧵👇

Art by @PowerDada

[History of Bitcoin - Smashtoshi @bysmashtoshi]

‘Not your keys, not your coins’ by @PowerDada appears in the History of Bitcoin Collector’s Book as well as our interactive timeline.

[History of Bitcoin - Smashtoshi @bysmashtoshi]

Bitcoin’s history is too important to be lost, distorted, or reduced to myths.

Today, History of Bitcoin officially launches. 🧵

https://t.co/Mx7uhxd8qx

[georgeboya 🕵️‍♀️🕵️‍♂️ @BoyaGeorge]

🎉Proud to announce the 65th collaboration for Partners in Crime 🕵️‍♂️🕵️‍♂️

🤝This time with legendary digital artist @Moxarra

🧐Coming at Monday 27/4 on @manifoldxyz

[Jack 🏴‍☠️ @JackTezos]

TEZOS ARCHIVER is here.

🔹 Store your Tezos token artifacts on the Internet Archive (Wayback Machine).

🔹 You don't need to connect your wallet.

🔹 Queue system, you can leave it running and go for a run with your dog.

🔹 Free.

🔹 Built with love.

How do you use it? ⬇️