Mike Stephane

Software Engineer 💻 #TechEnthusiast #Javascript #ReactJs #NextJs #Typescript #Angular #CSS #Webpack #NodeJs #Express #nginx Here for Tech Stuff

[Google Earth @googleearth]

Prepare for takeoff. ✈️ Flight simulator is now available globally on web to all users. https://t.co/hQP0No142P

We've recently added many our most powerful professional desktop features to web. Elevation profiles, new import types, but there's always been one other feature you've been asking us to add to the web version of Google Earth, just for fun...

Where will you fly? Share your best maneuvers, views, and flyovers with us!

[Addy Osmani @addyosmani]

https://t.co/0DyFIXJueI

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Chrome for Developers @ChromiumDev]

Stop slowing down your entire app just to test one API. You can now throttle individual network requests in Chrome DevTools to simulate specific bottlenecks without affecting the rest of your session → https://t.co/IrQ5RDVaTu

[Guillermo Rauch @rauchg]

A Vercel user reported an issue that sounded extremely scary. An unknown GitHub OSS codebase being deployed to their team.

We, of course, took the report extremely seriously and began an investigation. Security and infra engineering engaged.

Turns out Opus 4.6 *hallucinated a public repository ID* and used our API to deploy it. Luckily for this user, the repository was harmless and random. The JSON payload looked like this:

"𝚐𝚒𝚝𝚂𝚘𝚞𝚛𝚌𝚎": {
"𝚝𝚢𝚙𝚎": "𝚐𝚒𝚝𝚑𝚞𝚋",
"𝚛𝚎𝚙𝚘𝙸𝚍": "𝟿𝟷𝟹𝟿𝟹𝟿𝟺𝟶𝟷", // ⚠️ 𝚑𝚊𝚕𝚕𝚞𝚌𝚒𝚗𝚊𝚝𝚎𝚍
"𝚛𝚎𝚏": "𝚖𝚊𝚒𝚗"
}

When the user asked the agent to explain the failure, it confessed:

The agent never looked up the GitHub repo ID via the GitHub API. There are zero GitHub API calls in the session before the first rogue deployment.

The number 913939401 appears for the first time at line 877 — the agent fabricated it entirely.

The agent knew the correct project ID (prj_▒▒▒▒▒▒) and project name (▒▒▒▒▒▒) but invented a plausible-looking numeric repo ID rather than looking it up.

Some takeaways:
▪️ Even the smartest models have bizarre failure modes that are very different from ours. Humans make lots of mistakes, but certainly not make up a random repo id.
▪️ Powerful APIs create additional risks for agents. The API exist to import and deploy legitimate code, but not if the agent decides to hallucinate what code to deploy!
▪️ Thus, it's likely the agent would have had better results had it not decided to use the API and stuck with CLI or MCP.

This reinforces our commitment to make Vercel the most secure platform for agentic engineering. Through deeper integrations with tools like Claude Code and additional guardrails, we're confident security and privacy will be upheld.

Note: the repo id above is randomized for privacy reasons.

[Branko @brankopetric00]

https://t.co/BmzVV4LpqQ

[Branko @brankopetric00]

https://t.co/Y4K8YgJtyw

[Matt Pocock @mattpocockuk]

Every time I post this, I get so many WTF's in the comments.

It's the 'string & {}' trick.

Still absolutely essential for getting 'loose autocomplete' in library code.

[Lionel Ngendakuriyo @ngendlio]

With your approval, Excellency @WilliamsRuto, we can build a much better SHA platform for Kenyans, just like we did for the Rwandan's Social Security Board (@RSSB_Rwanda).

- This will be done for a fraction of the cost,
- Fully owned by Kenyans,
- In less than two years.
- Kenyans will have public real-time progress on the implementation.
- No Payment required until full data migration.

Much cheaper, faster, and better for Kenyans.

@citizentvkenya
Thank you.

#Kenya #TechForGood #LocalOwnership #Transparency #Innovation

[Mike Stephane @mike_stephane]

@davidsstraight @dhh Source: https://t.co/zv2YE3lQE0

[Mike Stephane @mike_stephane]

@davidsstraight @dhh Nope->“The name hasn't changed, but it's meaning has narrowed and lengthened from "everything user related" to "user usable programs and data". As such, some people may now refer to this directory as meaning 'User System Resources' and not 'user' as was originally intended.”

[Mike Stephane @mike_stephane]

@kentcdodds Pattern matching in v5 was much better. Moving pattern validation to components adds significant changes, especially for large apps relying on regex validation. For smaller apps, it's manageable. This is a big issue for teams planning to upgrade to v7

[Mike Stephane @mike_stephane]

A 10x Faster TypeScript https://t.co/h2pU1PU90O

[Zack Jackson @ScriptedAlchemy]

4 years old today! Though in the last year, id say we have done substantially more work than the last 3 years combined <3

[React Advanced Conference @ReactAdvanced]

See you at React Advanced London?

🚀Get ready for advanced React and Web Development topics on October 25 & 28!

🎓 60+ talks from top creators and maintainers
🌆 London vibes
💻 Hands-on workshops with the latest tech & practices
🎉 Networking and a party with fellow devs

[Mike Stephane @mike_stephane]

@TAbrodi Did you run the same command that the CI runs? Depending on your set up, can you also set your local to be the same “environment” as CI for debugging purposes ?

[Adam Rackis @AdamRackis]

You don't write C++ anymore Adam you don't need it
You don't write C++ anymore Adam you don't need it
You don't write C++ anymore Adam you don't need it
You don't write C++ anymore Adam you don't need it
You don't write C++ anymore Adam you don't need it
You don't write C++ anymo

[Massimo @Rainmaker1973]

Did you know you can layer emojis on an iPhone?

[📹 thatsannette]

[Jake Archibald @jaffathecake]

📝 HTML attributes vs DOM properties.

They're completely different, but often coupled.

Here's the difference, and why it matters: https://t.co/mQzFLN0zrO