Subham

to infinity & beyond.

[DHH @dhh]

It's never too late to discover your courage.

[Can Vardar @icanvardar]

i love the fact that we don’t think about CSS anymore

ai handles that shit

[conor brennan-burke @contextconor]

whoever successfully rebranded ‘bots’ as ‘agents’ is a god-tier marketer

[Michael Arnaldi @MichaelArnaldi]

This will piss you off but it's true

[Aravind Srinivas @AravSrinivas]

The best way to build a high pain tolerance is to remind yourself that the pain is temporary

[Electra @Electrarythm]

Joseph Campbell

[Rhys @RhysSullivan]

there's this valley of despair when programming with agents

you either have to be an inference maximalist or minimalist, but anywhere in between you just get slop and pain

[maria @maria_rcks]

I’m suffering from post-Fable depression

[StepSecurity @step_security]

🚨 Breaking: 31 npm packages from @RedHat have been compromised.

100,000+ weekly downloads affected. The upstream CI/CD pipeline was compromised, with all packages published via GitHub Actions OIDC.

The payload:
⚠️ Reads GitHub Actions runner process memory to extract masked secrets
⚠️ Sweeps credentials across AWS, GCP, Azure, K8s, Vault, and npm
⚠️ Self-propagating worm that republishes backdoored packages using stolen npm tokens, bypassing 2FA
⚠️ Persists on dev machines via Claude Code settings hijack and VS Code task injection
⚠️ Exfiltrates data through GitHub API commits, blending in with normal git operations

We have responsibly disclosed the incident to the maintainers.

Full technical analysis: https://t.co/63nZYH1cMO

[StepSecurity @step_security]

🚨 Active npm supply chain attack. 143 packages compromised in a single coordinated wave across the AntV (Alibaba) data visualization ecosystem, plus echarts-for-react, timeago.js, jest-canvas-mock, and others. Some ship over a million downloads per month.

🛡️ The C2 domain sits on the same infrastructure used in the actions-cool/* GitHub Actions compromise we reported earlier today. Every StepSecurity Harden-Runner customer, community tier and enterprise, was protected from second zero of this incident via our global block list.

🚨 We pushed a Threat Center alert to all StepSecurity enterprise customers with detection queries and remediation steps.

Here's how StepSecurity Enterprise customers are protected at every stage of the software development pipeline:

⚙️ CI/CD pipelines
1️⃣ Outbound connections to the C2 domain are blocked automatically
2️⃣ Runner.Worker memory read detection flags attempts to dump CI/CD secrets

📦 Code Repositories
1️⃣ npm package search detects compromised packages in default branches and pull requests
2️⃣ npm cooldown and compromised package GitHub checks automatically block pull requests from being merged

💻 Dev Machine Guard
1️⃣ npm package search detects compromised packages installed on developer machines.

🔒 For all stages, StepSecurity Secure Registry blocks these compromised packages from even reaching your environment in the first place.

https://t.co/egNcqXRLke

[StepSecurity @step_security]

🚨 BREAKING: node-ipc compromised. Again.
Three malicious versions of node-ipc (9.1.6, 9.2.3, 12.0.1) were published today carrying an identical credential-stealing payload. This package has 10M+ weekly downloads.

Here's what happened:
An attacker injected an 80KB obfuscated IIFE into the CommonJS bundle. It fires on every require('node-ipc') call. No special config needed, just importing the package is enough.

What it steals: → AWS, Azure, GCP credentials → SSH private keys → Kubernetes configs → Docker tokens → GitHub CLI tokens → AI tool configs (including Claude) → Terraform state → 90+ credential file patterns in total

Everything gets gzipped and exfiltrated to an attacker-controlled domain (sh[.]azurestaticprovider[.]net) via DNS TXT queries and HTTPS POST, designed to look like normal traffic.

The attacker published across two major version lines simultaneously (9.x and 12.x) to maximize blast radius. Semver ranges like ^9, ~9.1.x, ~9.2.x, ^12, and ~12.0 all resolve to compromised versions automatically on the next install or lockfile refresh.
Key details:
Only the CommonJS bundle (node-ipc.cjs) is affected. ESM imports are clean.
The 9.x releases are fabricated. The 9.x line never shipped a .cjs bundle before this attack.
This is a different actor from the 2022 peacenotwar incident. Purely financial, credential-theft motivation.
If you installed any of these versions, assume all secrets on that machine are compromised. Rotate everything.
Our full technical breakdown covers the attack chain stage by stage, IOCs, and how to check if you're affected:
https://t.co/l7m03coFQu

[StepSecurity @step_security]

🚨 ACTIVE INCIDENT: The Mini Shai-Hulud worm is back, and it just compromised dozens of official @tanstack npm packages

This is the first documented self-spreading npm worm that carries valid SLSA provenance attestations. Let that sink in.

Our OSS Package Security Feed detected the compromised releases and we're tracking the spread in real time.

Here's what happened:

The attacker staged an obfuscated 2.3 MB credential-stealing payload in a fork of TanStack/router, then used hijacked OIDC tokens to publish malicious versions through TanStack's own legitimate GitHub Actions release pipeline.

The compromised packages include @tanstack/react-router, @tanstack/router-core, @tanstack/react-start, and 40+ other packages. Millions of weekly downloads across the ecosystem.

If you installed any affected version in CI, assume all secrets in that environment are compromised. Rotate tokens immediately.

Full technical analysis, IOCs, compromised version list, and recovery steps on our blog. The list of affected packages is still growing.

https://t.co/kRiwPD0JGx

[StepSecurity @step_security]

🚨 A Mini Shai-Hulud has appeared.

Your npm install just handed your credentials to an attacker.

We detected a new supply chain campaign targeting SAP developer packages. It downloads Bun (not Node) to run an 11 MB obfuscated payload. Victim repos are being created on GitHub as we speak.

Full breakdown: https://t.co/j2GcVsgJWc

[Subham @subhamray_]

@DeepakNesss You have to choose your non-personal workspace during login. It doesn’t show up for personal workspace.

[Subham @subhamray_]

One compromised dependency = entire system at risk. That’s all it takes.

[StepSecurity @step_security]

🚨 Last week, North Korean state actors hijacked axios on npm. 300M+ weekly downloads. Turned into a remote access trojan.
We just published the behind-the-scenes story of how we detected it, fought the threat actor in real time, and helped the community respond.

[Sam Altman @sama]

I have so much gratitude to people who wrote extremely complex software character-by-character. It already feels difficult to remember how much effort it really took.

Thank you for getting us to this point.

[shaurya @shauseth]

my biggest takeaway from the gita was that it doesnt matter if she texts back

[dax @thdxr]

sent this to the team today

everything great comes from being able to delay gratification for as long as possible

and it feels like we're collectively losing our ability to do that

[dax @thdxr]

what if the models haven't actually improved for months
what if we're all just getting dumber