re13orn

reborn for light

[re13orn @re13orn]

😅

[International Cyber Digest @IntCyberDigest]

The bug is like a joke.

On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

[International Cyber Digest @IntCyberDigest]

The bug is like a joke.

On Alpine Linux, type 257 to 1024 characters of anything and you get root. 💀

[re13orn @re13orn]

NB!

[Billy Ellis @bellis1000]

At #hexacon - https://t.co/jEOpspETlT demos iOS 27.0.1 untethered jailbreak on iPhone 18 Pro

[Billy Ellis @bellis1000]

At #hexacon - https://t.co/jEOpspETlT demos iOS 27.0.1 untethered jailbreak on iPhone 18 Pro

[re13orn @re13orn]

🚨安全提醒：[email protected] 和 0.30.4 已确认是恶意版本。OpenClaw 源码构建不受影响，但在攻击窗口内执行过 npm install -g [email protected] 的环境存在历史暴露风险，建议立即排查 plain-crypto-js 及相关 IoC。#OpenClaw #axios #供应链投毒

[SlowMist @SlowMist_Team]

🚨 SlowMist TI Alert 🚨

Please check for Malicious Versions of #axios 1.14.1 / 0.30.4 and Historical Exposure Risk from global #OpenClaw npm Installation.

As of March 31, 2026, open-source intelligence indicates that [email protected] and [email protected] have been confirmed as malicious versions. Both contain an extra dependency, [email protected], which can deliver cross-platform malicious payloads via its postinstall script.

1️⃣/ The impact on OpenClaw needs to be assessed per scenario:

1) Source Build Scenario: Not Affected 🤖
👉 Lock files in v2026.3.28 actually lock [email protected] / 1.13.6, which are not malicious versions.

2) npm install -g [email protected] Scenario: Historical Exposure Risk Exists 🔍
👉 This is because the dependency chain includes:
openclaw -> @line/[email protected] -> optionalDependencies.axios@^1.7.4

During the time window when the malicious versions were online, [email protected] could have been resolved.

3) Current Reinstallation Result: npm now resolves to [email protected] 🧩
👉 However, environments that installed within the attack window should still be treated according to the affected scenario, and IoC checks are recommended.

2️⃣/ Reference for Checks

✅ Check for malicious versions and modules first:

npm list axios 2>/dev/null | grep -E "1.14.1|0.30.4"
grep -A1 '"axios"' package-lock.json 2>/dev/null | grep -E "1.14.1|0.30.4"
ls node_modules/plain-crypto-js 2>/dev/null && echo "POTENTIALLY AFFECTED"

✅ If OpenClaw was installed globally, also check the global path:

npm root -g
npm ls -g openclaw axios plain-crypto-js @ line/bot-sdk --depth=4

3️⃣/ Known IoC Path Checks

#macOS
ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "COMPROMISED"

#Linux
ls -la /tmp/ld.py 2>/dev/null && echo "COMPROMISED"

#Windows (cmd.exe)
dir "%PROGRAMDATA%\wt.exe" 2>nul && echo COMPROMISED

4️⃣/ Additional Notes

If the plain-crypto-js directory exists, even if its package.json has been cleaned, it should still be treated as a high-risk execution trace. ⚠️

For hosts that executed npm install or npm install -g [email protected] within the attack window, immediate credential rotation and host-side investigation are recommended.

[re13orn @re13orn]

@kevinzhow 哦?TG 使用codex👉试试 OpenFish ? https://t.co/8c0QZmWQKv

[re13orn @re13orn]

@oragnes claude 我推荐加上 --autoConnect，这样就可以管理已经打开的会话窗口，否则只会打开一个全新的，没有任何插件的窗口。命令：claude mcp add chrome-devtools --scope user npx chrome-devtools-mcp@latest -- --autoConnect

[re13orn @re13orn]

@trendsdotfun 谢邀。认真看了这次 Hackathon 的方向，当前项目重心与本次主题不完全一致，这次就先不参加了。
祝活动顺利，也期待看到大家的作品。🥳🥳

[re13orn @re13orn]

OpenFish v1.2.0 🐟 发布。

小鱼一直在持续迭代进步！ 💪

终于把 Agent 最烦的一点干掉了：

长任务做到一半，总停下来等你再发一句“继续”。

现在有了 Autopilot。

A 盯进度，B 干活。

任务全自动跑，你只需要做一名观察者。

https://t.co/8c0QZmWQKv

#openclaw #agent #openfish #AI

[re13orn @re13orn]

@shizhiang1 不，强推 codeX 🥳

[re13orn @re13orn]

现在的 openclaw 🦞 就和当初的 cursor 一样，从被质疑到大火但是不够颠覆性🔥，直到不久的 cc 和 codex 面世，ai 写代码就已经极其强大。 openclaw 虽不好用，但是你得跟上，很快，极其好用的产品已经在路上了。#AI #OpenClaw #OpenFish

[re13orn @re13orn]

@Lonely__MH 完全支持，之前反重力额度大到用不完，现在付费问几个问题后限额了，要么就是经常断网😤

[re13orn @re13orn]

@shachepi 玩不起了🤣

[re13orn @re13orn]

@coder_left 反重力现在稍微一用就开始限量了🤣

[re13orn @re13orn]

@flrande 如果你使用 Telegram 和 codex，推荐你使用小鱼 openfish 🐟 ，完全开源， pip install 开箱即用，支持 docker 安全免费 😆 https://t.co/8c0QZmWQKv

[re13orn @re13orn]

OpenFish v1.0.0 正式发布。

把 Codex 装进 Telegram。
离开工位，也能继续推进本地项目。

支持在 TG 里提问、执行、续接上下文、审批，以及管理项目 / 任务 / MCP / 会话。
坚持 local-first：代码、执行、状态、审计都留在你自己的机器上。

pip install openfish
GitHub: https://t.co/8c0QZmWQKv

[re13orn @re13orn]

@imwsl90 写好了，OpenFish 🐟 https://t.co/8c0QZmWQKv

[re13orn @re13orn]

@joooe453 openclaw🦞 太笨重了，个人还是比较习惯使用 codex cli，毕竟 codex cli 本身就是一个牛逼的 Agent，mcp/skills/memory 都原生支持，如果你也习惯使用 codex，习惯简单清爽，欢迎体验 openfish 🐟🐟🐟，项目地址： https://t.co/8c0QZmWQKv

[re13orn @re13orn]

@frozenraspberry openclaw🦞 太笨重了，个人还是比较习惯使用 codex cli，毕竟 codex cli 本身就是一个牛逼的 Agent，mcp/skills/memory 都原生支持，如果你也习惯使用 codex，习惯简单清爽，欢迎体验 openfish 🐟🐟🐟，项目地址： https://t.co/8c0QZmWQKv

[re13orn @re13orn]

@im23pds 有变种 🤣🤣，小鱼 🐟🐟openfish: https://t.co/8c0QZmWQKv