Sebastian Gräf

Seniror DevOps and Cloud Infrastructure Consultant @ Microsoft

[Sebastian Gräf @segraef]

#SecKit provisions every scanner, sweeps any repo for secrets, CVEs, IaC misconfig and malicious packages, drops in AI guardrails plus CI, audits GitHub/Azure posture, and vets AI skills and MCP servers 0-100 before install.

#DevSecOps #AppSec #SupplyChainSecurity #AISecurity

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a npm supply chain compromise impacting 90+ redhat-cloud-services/* packages, including patch-client 4.0.4, insights-client 4.0.4, rbac-client 9.0.3, host-inventory-client 5.0.3, frontend-components 7.7.2, and others. The payload is a self-propagating worm that infects other npm packages and self-publishes.

Each compromised package adds a malicious preinstall hook, embedding an index.js script in the package.json that silently executes “node index.js” during installation, downloads Bun, and runs a payload that steals secrets from npm, GitHub, Amazon Web Services (AWS), and Secure Shell (SSH). The added code bloats index.js from ~8KB to ~4.3MB, acting as a heavily obfuscated ROT-9 eval loader.

If any of the compromised packages are installed, users and organizations should assume compromise, rotate credentials, revert to a previously trusted version, and block compromised packages. Identified compromised npm packages have been taken down, and we continue to work with the npm team. Microsoft continues to investigate this attack and will publish updates as more information is available.

[禿道道🐟 @dearemon]

My Apple Car.

[Sawyer Merritt @SawyerMerritt]

New Starship wallpaper🔥

[Elon Musk @elonmusk]

I love giant machines

[Elon Musk @elonmusk]

Starship V3 with Raptor 3

[皓樂芒 @howlemont]

微软，总算出了个好东西。

开发了一款工具，

可以将几乎任何格式pdfs，word，docs，excel，PowerPoint，Audio，YouTube 网址

转换为Markdown文件，
众所周知Markdown 是AI 大语言模型最青睐的格式。

没有自定义解析器。没有损坏的布局。没有混乱的文本。

只是干净、结构化的标记，

只需一次安装

https://t.co/gyZGOdceG7

[Sebastian Gräf @segraef]

My journey so far

[Sebastian Gräf @segraef]

@DoctorLemma Gustave Le Bon - Psychologie des Foules

[Tom Dörr @tom_doerr]

Removes AI writing patterns from prose

https://t.co/7nEXW5ie0e

[Giga Based Dad @GigaBasedDad]

🎯

[Yousif Astarabadi @yousifa]

https://t.co/Qmta9nro9I

[Perplexity @perplexity_ai]

Announcing Personal Computer.

Personal Computer is an always on, local merge with Perplexity Computer that works for you 24/7.

It's personal, secure, and works across your files, apps, and sessions through a continuously running Mac mini.

[Tibo @thsottiaux]

Our codex offsite left a deep impression on me.

I am beyond excited for what the next 10 or so weeks will bring and I think the current state of coding agents will be remembered as being so primitive that it will be funny in comparison.

[Sebastian Gräf @segraef]

Accelerate app development by using GitHub Copilot https://t.co/ADzAiA1vwo

[Sebastian Gräf @segraef]

Build Apps and Agents with Visual Studio Code and Azure https://t.co/b1H5EWZB8Z

[Sebastian Gräf @segraef]

Agentic DevOps: Evolving software development with GitHub Copilot and Microsoft Azure https://t.co/XwoQRFKFmY

[Sebastian Gräf @segraef]

@compscidr And for suffix wildcards you can use URLs, see the link.

[Sebastian Gräf @segraef]

@compscidr Example: packages.contoso.corp will allow traffic to packages.contoso.corp and prod.packages.contoso.corp, but not artifacts.contoso.corp.

[Sebastian Gräf @segraef]

@compscidr Seen https://t.co/GbVdk0jpsu?