Nick Smit

Product, growth, startups. Cofounder & Chief Product Officer @safetycli. Prev. Amazon EventBridge @awscloud, @kickstarter & Co-founder @Huzza_Live.

[Nick Smit @nickste]

@steipete Current generation of EDR (Crowdstrike et al) isn’t anywhere near sufficient for the new generation of software dev. Zero visibility into packages, skills, MCP, or IDE Extension. And no protection/governance. I wrote more about it here: https://t.co/UwVta3NNrR

[Nick Smit @nickste]

@QuinnyPig And the keynote wasn’t the only talk that was a thinly veiled vendor pitch. And most of us paid $900 for the pleasure 😩.

[Nick Smit @nickste]

Or just https://t.co/oWI3ufVj7Y and we’ll scan every machine in your org. to detect the malicious package (and many others!) for you.

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft is investigating mistralai PyPI package v2.4.6 compromise. Attackers injected code in mistralai/client/__init__.py that executes on import, downloads hxxps://83[.]142[.]209[.]194/transformers.pyz to /tmp/transformers.pyz, and launches a second-stage payload on Linux. The file name transformers.pyz appears deliberately chosen to mimic the widely used Hugging Face Transformers library and blend into ML/dev environments.

The main payload is a credential stealer, but it also includes country-aware logic; it avoids Russian-language environments and contains a geo fenced destructive branch that has 1-in-6 chance of executing rm -rf / when the system appears to be in Israel or Iran.

To mitigate this threat: isolate affected Linux hosts, block 83[.]142[.]209[.]194, hunt for /tmp/transformers.pyz, pgmonitor[.]py, and pgsql-monitor.service, and rotate exposed credentials.

[Nick Smit @nickste]

@Bitwarden Need to figure out who on your team has Bitwarden installed on their machine? https://t.co/oWI3ufULiq or DM me.

[Nick Smit @nickste]

This is why the only viable solution to software supply chain security MUST protect the developer workstation. That is now the single most vulnerable part of our entire industry.

You have to be constantly scanning the dev endpoint, like we are @safetycli, to detect and protect.

[DBCrypto @DBCrypt0]

The most insane long game hack of all time!

North Korea built an entire trading firm

Conference passes
In-person meetings
Multiple countries

Half a year of Telegram messages and working sessions

Even $1M of their own capital deposited to look legitimate

Then when all the pieces were in place they stole $280M

Drift just released the full incident background and it’s wild!

Fall 2025: A "quant trading firm" approaches contributors of Drift at a major conference.

They Follow up in person across multiple countries. Technically fluent. Verifiable backgrounds. Typical trust building stuff.

December-March: They onboard a real Ecosystem Vault and attend working sessions

They even deposit $1M to further build ‘trust’

The long con had set in and by early 2026, these weren't strangers anymore

They had now built a 6-month working relationship

Then they share some repos which is routine stuff

The attack vector: a VSCode/Cursor vulnerability flagged by the security community throughout late 2025. Opening a file was enough. Silent code execution. No prompt. No warning. Nothing.

The moment the exploit fired, every Telegram message and trace of malware was scrubbed clean

No record or trace left

Every team managing meaningful TVL is a target and no one is safe from professional jobs such as this

Six months of infiltration and a trusted relationship, not just a sketchy email link

The bug is patched but the real attack vector was the relationship and patience

How do you protect against that? 🤯

[Nick Smit @nickste]

@karpathy We caught this one early @safetycli and our customers using Safety Firewall got immediate protection from these malicious releases. More here: https://t.co/rJlkThfMpR

[Nikki Pinski @pinskinator]

I wrote a thing. Actually I wrote it in December. But now I made a public home for it. https://t.co/G00SEfK4YT

Watch this space. Coming later this week: A Practical Guide to Agentic Engineering.

[Nikki Pinski @pinskinator]

My job has changed, but not that much.

[Eric Johnson @edjgeek]

It's here!! This is the one I have been talking about! AWS Lambda Durable Functions are now officially out. If you want to see a deep dive of this, My buddy Michael Gasch (one of the PMs behind the magic) and I are presenting this on Wednesday. The catalog is getting updated, but watch for CNS380.

https://t.co/EzfOVFf7kz

[Nick Smit @nickste]

@pinskinator @astuyve I’m in my DM with you. How do I quickly see that you’ve replied to an earlier message of mine that is above the visible chat window area?

[Nick Smit @nickste]

@pinskinator @astuyve Nikki you’re completely wrong here. The UX of having to find a threaded reply in a DM sucks (they just aren’t easily noticeable without moving to the Threads page). AJ wins this one.

[Nick Smit @nickste]

@chrismunns Sorry to hear Chris - rest up and hope you feel better soon. And thanks for the nudge - so much we can solve with modern medicine, but requires diligence from all of us.

[Nick Smit @nickste]

Fantastic to see logging for Amazon EventBridge launched! It took a while, but this will make it significantly easier to debug what's happening in your event bus. Congrats to the team!

[Dan Ronald @DRo_604]

Game changing launch for Amazon EventBridge timed with the New York summit (where EventBridge was launched 6 years ago)! EventBridge now supports logging to CloudWatch, S3, and Firehose, giving you a new level of visibility across your applications.
https://t.co/W1CcYPkg2m

[Marc Brooker @MarcJBrooker]

New blog post, with some career advice: https://t.co/hmpKGDHjhh

[Nick Smit @nickste]

@chrismunns You using Claude Code? Running it in VS Code in integration mode is killer.

[Nick Smit @nickste]

@der_rehan Congrats Rehan!

[Nick Smit @nickste]

I’m at #RSAC2025 this week! If you’re also in town, let me know — I’d love to say hi!

[Nick Smit @nickste]

Upgrading from 18GB to 64GB MBP is such a massive quality of life improvement. I've gone from always feeling constrained around what I open or leave open, to instead feeling an unconstrained abundance.

All the Firefox tabs. All the Docker containers. All the IDEs.

[Nick Smit @nickste]

@zackkanter Hell yeah! Love to see these results following all the hard work y’all have put in. Zack is next level. 🚀

[Nick Smit @nickste]

Our research team @safetycli found a NPM package published by a large payment processor ($80B/year) that leaks credit card details to an ngrok endpoint. An unfortunate example of how a legitimate actor can compromise your software supply chain. https://t.co/9579bQoQiM