@I_CU_boy Rough year. Went from thinking we had a shot at multiple championships to the AFC Championship loss, Nuggets exit, and then this WCF collapse. Gutting.
My God that was one of the most disappointing and depressing ends to a season I can remember.
Like falling off a cliff.
Into quicksand.
Wearing a weight vest.
On your wedding day.
🚨 GitHub is investigating TeamPCP’s claim: ~4,000 internal repositories allegedly stolen and listed for sale ($50,000+).
This comes as the group’s Mini Shai-Hulud worm just hit #Microsoft’s durabletask PyPI package (v1.4.1–1.4.3) — a #Linux-only infostealer that spreads via AWS SSM + Kubernetes.
Worth rotating secrets and scanning your repos.
Full story: https://t.co/m6iAHb1pXA
🚨 BREAKING: Socket is investigating an active npm supply chain attack compromising hundreds of packages in the @antv ecosystem.
The malicious publish wave appears tied to Mini Shai-Hulud and packages connected to the npm maintainer account atool.
dictation in the new @raycast is really good
- custom instructions for how you want it to be formatted
- use context from active app to improve accuracy
- custom vocabulary for those tricky words
- custom styles for diff processing on diff apps (ie: slack, twitter, email)
- dictation history!
https://t.co/17SEMkwXzQ
This is why @pnpmjs's latest v11 release was the top story in Socket Weekly this past week - it includes smart defaults that put roadblocks in front of attacks like this.
Hard to imagine a more relevant release for this week’s supply chain chaos. 🔮
https://t.co/IE1l8KhvdB
🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading.
Newly confirmed compromised artifacts:
@opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads)
mistralai: 2.4.6 on PyPI
guardrails-ai: 0.10.1 on PyPI
additional @squawk/* packages on npm
guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.pyz, writes it to /tmp/transformers.pyz, and runs it with python3 without integrity verification.
The git-tanstack.com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds
Regardless I just came to say hello :^)”
The page also linked to a YouTube video and you can probably guess which one.