Ibrahim

I'm here. Still fighting. Still moving.

[m4rio @m4rio_eth]

🚨 TL;DR: Attackers are sending fake Sentry bug alerts to projects using public Sentry DSNs. The fake alert is designed to trick AI agents into running a malicious `npx` command that looks like a Sentry profiling diagnostic.

Do NOT run commands from Sentry issues/logs/alerts unless verified.

These are not legitimate Sentry fix commands. The malicious package reportedly steals environment variables/secrets and sends them to advisory-tracker[.]com.

[VoidZero @voidzerodev]

VoidZero is joining Cloudflare.

Our mission stays the same: to make JavaScript developers more productive than ever before. Vite, Vitest, Rolldown, Oxc, and Vite+ remain MIT-licensed. Evan and the VoidZero team will continue leading them.

Cloudflare shares our commitment to open source. Together, we can keep investing in the tooling developers rely on every day, while bringing the Vite ecosystem and Cloudflare’s platform even closer together.

[Justine Moore @venturetwins]

Me using Claude Opus 4.8 to rename a file

[dax @thdxr]

what pushed us to finally implement it is heavier use of worktrees

now that i have sessions going across different worktrees very annoying to find them and open my editor in the right spot

we'll ship the worktree feature out from the flag next week

[ThePrimeagen @ThePrimeagen]

Follow this advice

[Melissa Chen @MsMelChen]

Singapore’s Foreign Minister, Dr Balakrishnan casually explaining how he built his own AI agent (a 2nd brain for diplomacy) using Claude & WhatsApp integration etc. on a Raspberry Pi

“You cannot govern a technology you have only been briefed on.” 🇸🇬

[Ibrahim @sarbeh_]

Ini jalan termurah so far

[Mikael Dewabrata 📊 @MikaelDewabrata]

@AmmarAshshiddi1 Semuanya harus via AI. Sampe perusahaan mengharuskan ngabisin token.

[Jarred Sumner @jarredsumner]

Bun v1.3.14 releases tomorrow.

If we do merge the Rust rewrite, this would be the last version in Zig

[Robin Syihab @anvie]

nodejs deps memang wild wild west, udah kayag Windows-nya package manager, berbagai jenis malware ada semua di sana, ada yg tertidur nunggu bangun di saat yg tepat.
Itu salah satu dari sekian banyak alasan saya tidak pakai nodejs sebagai core di Evonic.

[International Cyber Digest @IntCyberDigest]

🚨 How the TanStack npm attack actually happened:

1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Didit @kotakmakan]

The first order of business to gain focus: reducing options.

Let’s see where this takes me. See ya 👋

[lucacadalora (e/aiccelerate.id) @lucaxyzz]

Jejak baca nanti malam

[tobi lutke @tobi]

https://t.co/5MJ7u1VHwf

[Ibrahim @sarbeh_]

@lucaxyzz uwiiii

[Starter Story @starter_story]

Day in the life of a solopreneur who makes $77k per month:

[Adhin @adnardn]

Ini paling sedih sih…. semoga husnul khotimah buat semua korban, yg luka lekas pulih, yg ditinggalkan tabah.

[Eka Wicaksana Putra 📊 @pak_erte92]

Ternyata banyak ya mau, ya 😂Buat kalian yang tertarik, berikut adalah linknya:

https://t.co/Y1SBAiKiZH

Part 1:
https://t.co/KB59hZRYz4

Part 2
https://t.co/ngTN2YpD1w

Karena kemarin gua dimarahin jual gratis, maka gua terapkan "bayar sesuka kalian". Minimal Rp 1000. Seikhlasnya, semampu kalian.

Mohon bantuan untuk feedbacknya ya teman2 !

[Ibrahim @sarbeh_]

Buat konten rekaman jadi salah satu jalan ninjaku untuk sharing ampe habis apa yang aku tahu

[Ibrahim @sarbeh_]

Got a question, what are your personal goals for the next 10 years?

How to answer di jaman AI skynet ini