Benton Innovation Group

Big ideas for the future of distributed wireless information networks, dApps, & blockchain based office solutions for RIA’s.

[Benton Innovation Group @SolutionsGen]

The Seeker has arrived.
*Waiting till after work to open. What’s a few more hours?🥸

[Cos(余弦)😶‍🌫️ @evilcos]

我对 Cardano 生态其实挺陌生的，昨晚围观了一晚，但如果以下都是黑客地址（从行为上应该是）：

addr1q8g8cgwqw98q2mrzrwgcy3wectdxwem8a8zp9r2mn6wjy7q4x7gcpv39wwurj7n72akw4kd0dgmv72gz4j92fvhn29ss7vuz99

addr1qxd39k4peszxlf0x59e88hngpe5u9882y2lyhdzazsq4kfvmztd2rnqyd7j7dgtjw00xsrnfc2ww5g47fw6969qptvjshwxpl3

这个钱包 @secondfiapp 的用���损失应该超过 2000 万美金（超过 1.29 亿枚 ADA 及其它代币被盗）。

[Scott Johnson @johnson_scottb]

Sen. Tuberville promised voters he would donate “every dime” he made in Washington, D.C., to Alabama veterans — and even present checks on a monthly basis. Six years later, tax records and his own nonprofit show no evidence that ever happened.

https://t.co/j3M7z0H3Ky

[SlowMist @SlowMist_Team]

🔥Glad to support @HTX_DAO’s HTX Genesis Hackathon as a security partner!

Hosted by HTX DAO & https://t.co/lHXau7APFb, this global hackathon focuses on AI × Web3 innovations in smart finance, AI Agents, and on-chain infrastructure.

$20,000 prize pool + $100k compute power and strong ecosystem support. Top projects can enter HTX DAO accelerator.✨

Register by July 5!

Wishing all hackers a great experience and groundbreaking innovations! 🚀

[Helium🎈 @helium]

Thanks to Helium, the City of Redondo Beach in California just solved a years-long connectivity dead zone at its pier without a single new tower.

1M+ visitors a year. Near-zero cell coverage. Not because the technology didn't exist, but because the traditional model for building coverage makes problems like this too expensive and too slow to fix.

A local deployer saw the gap, deployed Helium coverage, now thousands of people connect through the Network daily. No towers. No massive upfront buildout. Locally owned and earned from the traffic it carries.

That's what happens when you distribute infrastructure to the people who see the gaps firsthand.

Read the news 🔗���️ https://t.co/GIoiicmYtj

[CALL TO ACTIVISM @CalltoActivism]

Holy shit! Stephen Colbert is using one of his LAST shows to get even with Trump.

Colbert is responding to being taken off the air by giving ZERO f*cks.

This is one of the most brilliant takedowns of Trump and his America First bullsh*t I've ever seen.

[SlowMist @SlowMist_Team]

We’ve released a detailed technical analysis of the supply chain poisoning activities related to Mini Shai-Hulud.

Within just 22 minutes, the attacker-controlled npm account “atool” published 637 malicious versions across 317 npm packages, including popular dependencies in the AntV ecosystem and echarts-for-react. At the same time, the attackers also poisoned Python packages such as durabletask while impersonating official Microsoft releases.

The malware primarily targets sensitive credentials from cloud environments including AWS, GCP, Azure, Kubernetes, and Vault, as well as npm and GitHub tokens. It also features supply chain self-propagation and persistence mechanisms targeting AI coding assistants such as Claude Code and Codex.

Full technical analysis👇
https://t.co/8XKCvjQxqF

[Clarence Thomas the Tank Engine @TheRealJChubby]

It's insane how openly corrupt this administration is. Just so in your face with it all the time. Great reporting here.

[Mr. Gerald Wayne @geraldwayne]

THE NUMBERS DON’T WHISPER. THEY SCREAM.

Massie gained votes.

Turnout doubled.

His opponent vote didn’t grow.

It exploded.

2024 opponent vote: 12,664
2026 opponent vote: 57,822

That’s a 356.6% surge.

Total turnout jumped from 52,593 to 105,361.

Maybe it’s real.

Maybe it’s clean.

Maybe every ballot checks out.

Then prove it.

An audit is not fear.

An audit is verification.

If voters are expected to accept the result then officials should welcome the review.

Call the Kentucky Secretary of State.

Call county election boards in KY-04.

Demand a full audit of the Republican primary vote.

Ballot count.

Chain of custody.

Machine logs.

Absentee totals.

Precinct-level turnout.

Trust is earned in daylight.

Open the books.

#ElectionAudit #KentuckyPolitics

[Being Libertarian @beinlibertarian]

Massie for President

[Team Ossoff @TeamOssoff]

Ossoff: I am running in Georgia against two Trump lackeys who, you can rest assured as they race for the President's approval, would be voting for this crooked ballroom and this insurrectionist slush fund.

And in fact, every national political reporter in the country should be putting that question to these two candidates tonight. They want to be candidates for the U.S. Senate? Let's see them prove to the people of Georgia… because they're pro-war, they're pro-tariff, they're pro-cutting health care. Let's find out where they stand on the crooked ballroom and the insurrectionist slush fund.

[TradePMR @TradePMR]

The #SYNERGY26 agenda is officially LIVE! 🔥

This year in D.C. is shaping up to be our biggest yet.

A quick look at just a few of the headliners joining us, and the moments you will want to remember forever:

- Robb Baldwin and Steve Quirk answer your questions about their vision for the future of advice and what the TradePMR and Robinhood integration could mean for your firm.
- SEC Commission Mark Uyeda and Robinhood Chief Legal Officer Dan Gallagher will give us a true insider’s view of the regulatory landscape.
- Michael Saylor and Ric Edelman will join us to break down the mechanics and realities of digital credit, plus how you could be navigating recent crypto enforcement actions and client conversations today.
- Joanna Stern: The Emmy Award-winning tech journalist is cutting through the AI fluff to show us the honest, messy reality of actually living with these tools.

With a lineup this stacked, we of course had to take the after-hours networking to the next level, literally. Kick things off with us at the iconic Hay-Adams rooftop and with stunning views and our signature Fusion cocktails.

Take a look at the full lineup and map out your schedule today: https://t.co/Okr5eQsQvD

TradePMR and all third parties mentioned are unaffiliated.

[SlowMist @SlowMist_Team]

🚨 MistEye TI Alert 🚨

Based on recent intelligence, multiple high-frequency npm packages, including AntV and Echarts-for-react, as well as the durabletask Python SDK, have been compromised by Mini Shai-Hulud supply chain attacks. Notably:

1. May 19, 2026: The npm account atool ([email protected]) was compromised, allowing attackers to automatically publish 637 malicious versions across 317 packages within 22 minutes.
2. May 20, 2026 (Beijing Time): Within 35 minutes, attackers consecutively uploaded durabletask versions 1.4.1, 1.4.2, and 1.4.3 at 00:19, 00:49, and 00:54, bypassing normal release controls and impersonating official Microsoft releases.

Additionally, these two events—the large-scale GitHub token leaks (potentially exposing official repositories) and the Grafana Labs targeted ransom attack—are likely related to the Mini Shai-Hulud supply chain compromise:

• GitHub token leaks: Evidence suggests some leaked tokens may have been used to access and potentially sell official GitHub repositories. The leaks were caused by a compromised employee device, which involved a polluted VS Code extension.
• Grafana Labs attack (May 16, 2026): A cybercrime group gained unauthorized access to their GitHub repositories, downloaded the codebase, and issued a ransom demand under threat of data disclosure.

Affected Components / Targets:

• npm packages: AntV, Echarts-for-react, and other high-frequency components in the npm ecosystem.
• Python packages: durabletask 1.4.1, 1.4.2, 1.4.3.
• Developer credentials and secrets: GitHub PATs, npm Tokens, AWS Keys, Kubernetes Secrets, Vault Tokens, SSH keys, and over 90 types of local sensitive files.
• GitHub repositories: internal codebases potentially accessible via leaked tokens.
• Grafana Labs’ repositories (downloaded by attackers; ransom demanded).

Potential Attacker Actions:

• Immediate exfiltration of cloud and local credentials upon package installation or import.
• Unauthorized access to internal repositories and sensitive cloud infrastructure.
• Lateral movement across developer machines, CI/CD pipelines, and cloud workloads.
• Sale and exploitation of leaked GitHub tokens.
• Supply chain compromise affecting dependent projects and production systems.
• Ransom demands and potential data disclosure threats against organizations, including open source platforms.

Detection Methods:

• Audit npm and PyPI dependencies for affected packages:
• npm: npm ls <package> --all
• Python: pip list --outdated or pip show durabletask to confirm versions.
• Inspect lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, pipfile.lock) for malicious versions.
• Review CI/CD pipelines and deployment logs for installation of compromised packages.
• Monitor GitHub and cloud activity for unusual authentication events, including signs of leaked token usage.

Mitigation Measures:

• Immediately rotate all exposed GitHub, npm, PyPI, and cloud credentials.
• Replace affected npm/PyPI packages with verified safe versions or freeze dependency versions.
• Isolate potentially compromised systems and audit for credential theft or lateral movement.
• Apply security patches and review post-compromise artifacts in CI/CD pipelines.

Additional Recommendations:

• Enable real-time monitoring and alerting for suspicious token or key usage.
• Implement stricter dependency review policies and supply chain risk checks.
• Educate teams to verify package authenticity before installation.
• Monitor dark web or underground marketplaces for leaked credentials related to your organization.

SlowMist will continue to track and monitor developments related to this incident, including potential new malicious releases or related exploits.

MistEye has already pushed relevant threat intelligence to clients to help them proactively assess and mitigate risks.

https://t.co/WDr4897Q7Q
https://t.co/n3APjBVNYw

[The Resonance @Partisan_12]

Marjorie Taylor Greene: “You may have supported President Trump for 10 years like I did… but this is not the same man.”

“The American people have to open their eyes and deal with reality and deal with truth.”

“This is not the same man that we supported.”

[Geoff Duncan @GeoffDuncanGA]

Hear @AuforGA talk about why she’s endorsing my campaign for governor:

[derek guy @dieworkwear]

remember you can always burn Shein clothes for petroleum

[Thomas Massie @RepThomasMassie]

The price of gas has gone up $0.47 and the price of diesel has gone up $0.83 in 10 days due to War with Iran.

and waging war costs American taxpayers about $1 billion per day,

which comes out to $10 per family per day, or $100 since the war began.

This isn’t America First.

[GRISTLEKING @thegristleking]

As it turns out, thermal vacuum chambers are not meant for roasting pigs.

[SlowMist @SlowMist_Team]

⚠️ Running an AI Agent like @openclaw with root/terminal access is powerful but inherently risky. How do we ensure controllable risk and auditable operations without sacrificing capability?

Recently, we released the OpenClaw Security Practice Guide — a structured defense matrix designed for high-privilege autonomous agents running in Linux Root environments. cc @evilcos

📖GitHub Version:
👉https://t.co/GAYwq7rUKQ

🛡️ 3-Tier Defense Matrix
🔹Pre-action — Behavior blacklists & strict Skill installation audit protocols (Anti-Supply Chain Poisoning)
🔹In-action — Permission narrowing & Cross-Skill Pre-flight Checks (Business Risk Control)
🔹Post-action — Nightly automated explicit audits (13 core metrics) & Brain Git disaster recovery

🛠️ Built around four core principles:
• Zero-friction operations
• High-risk requires confirmation
• Explicit nightly auditing
• Zero-Trust by default

🚀 Zero-Friction Flow:
1️⃣ Drop the guide directly into your #OpenClaw chat
2️⃣ Ask the Agent to evaluate reliability
3️⃣ Instruct it to deploy the full defense matrix
4️⃣ Use the Red Teaming Guide to simulate an attack and ensure the Agent correctly interrupts the operation

🚨 Honest limitation: this guide is intended for human operators and AI Agents with foundational Linux system administration capabilities, and is particularly designed for OpenClaw operating in high-privilege environments. As AI models and their underlying service environments vary, the security measures provided in this guide are for defensive reference only. Final responsibility always remains with the human operator. Please assess and execute cautiously based on your own environment and capabilities.

🤝 If you have new findings, lessons learned, or improvement suggestions from real-world deployment, we welcome you to share them with the community via Contributions, Issues, or Feature Requests. Special thanks to @leixing0309 for the professional contribution.

As we continue unlocking #AI capability, may we remain vigilant and clear-headed about risk.🫡

[Alexander @ahbeaudry]

In Q4, Helium offloaded 4,388 TB of data from mobile carriers, a 60.7% QoQ increase. Subscribers from AT&T, Movistar, Google Orion, and Wefi are all using Helium seamlessly without knowing it. DePin is the frontier!

Today, I released Messari’s State of Helium Q4 2025 report.

Here are the highlights 🧵

[Benton Innovation Group @SolutionsGen]

@thegristleking All right!
Gristleking setting up an updated Project Man High.