Kim

developer fueled by coffee and stickers

[Kim @thinkverse]

@dee_hw @autonomous_labs I've said it before, and I'll say it again. This is such a good idea.

We spend a huge amount of time at our desks, so why not let our desks help us with more than just holding our stuff. 👏

[International Cyber Digest @IntCyberDigest]

‼️🚨 A new npm supply-chain attack compromised 57 packages across over 286 malicious versions in under 2 hours. The attackers used self-replicating malware, a new version of the Miasma worm, which also used evasion techniques to stay under the radar.

The payload targets CI/CD and developer credentials, including GitHub Actions secrets, cloud credentials, Vault tokens, SSH keys, npm and GitHub tokens, and password-manager stores. This variant also injects AI coding assistant config files at `.claude`, `.cursor`, `.gemini`, and `.vscode` paths, a separate persistence and repo-poisoning angle.

[VoidZero @voidzerodev]

VoidZero is joining Cloudflare.

Our mission stays the same: to make JavaScript developers more productive than ever before. Vite, Vitest, Rolldown, Oxc, and Vite+ remain MIT-licensed. Evan and the VoidZero team will continue leading them.

Cloudflare shares our commitment to open source. Together, we can keep investing in the tooling developers rely on every day, while bringing the Vite ecosystem and Cloudflare’s platform even closer together.

[Autonomous @autonomous_labs]

We added 5 sensors. They track 7 metrics, each mapped to published research on long sessions.

Environment, air quality, presence.

Simple thesis: whenever the room feels wrong, the code will reflect what's wrong before your body can name it.

That's how we made Thinking Desk.

[JFrog Security @JFrogSecurity]

🚨 Supply Chain ALERT New Phase of “Miasma: The Spreading Blight” 🚨

A new wave of the npm supply chain campaign, Miasma: The Spreading Blight
Targets include @‌vapi-ai/server-sdk & ai-sdk-ollama. Attackers are using a new autorun install method exploiting node-gyp shell expansion.

We have updated our previous blog:
https://t.co/gFhlSCFzOu

[Kim @thinkverse]

New @twilio SendGrid spam going around. 👇

I've gotten a few today from different emails. Some spam originated from StacyWitbeck[.]com, this one in the image is from ai2sql[.]io

So if you use SendGrid, be on the lookout.

[Kim @thinkverse]

@kycklinggull1 @GermanStrands I've never seen digital go down unless it's a sale. 🤷‍♂️

[Kim @thinkverse]

@kycklinggull1 @GermanStrands Yeah, the cheapest I found was $85…
https://t.co/XlpYReBemM

[Kim @thinkverse]

Holy damn, Wolverine is $85 in Sweden, upwards of $90 in some stores, and on the @PlayStation store it's $95! 😬

[Kim @thinkverse]

Time to run `ollama run gemma4:12b-mlx`, available as of @ollama v0.30.3. 👊

[Google Gemma @googlegemma]

Meet Gemma 4 12B!

A unified, encoder-free multimodal model designed to bring high-performance intelligence directly to your laptop, and released under an Apache 2.0 license.

Bridging the gap between edge efficiency and advanced reasoning. Here is what’s new with Gemma 4 12B: 👇

[Kim @thinkverse]

Wake up! New version of Gemma 4 just dropped. 🔥

[Google Gemma @googlegemma]

Meet Gemma 4 12B!

A unified, encoder-free multimodal model designed to bring high-performance intelligence directly to your laptop, and released under an Apache 2.0 license.

Bridging the gap between edge efficiency and advanced reasoning. Here is what’s new with Gemma 4 12B: 👇

[Kim @thinkverse]

Holy damn, Wolverine is $85 in Sweden, upwards of $90 in some stores, and on the @PlayStation store it's $95! 😬

[Kim @thinkverse]

@resend Wow, 3M, huge congratulations! 🍻

[Kim @thinkverse]

@DomTheBomb Yeah, and like a year and a half since the reveal of Intergalactic, and not a peep since. 😔

https://t.co/y2sfWgpOzh

[Neil Druckmann @Neil_Druckmann]

Blast off! Intergalactic: The Heretic Prophet is our next big thing! Enjoy this first look at Naughty Dog's wildest adventure yet!

[Packagist @packagist]

⛔ Composer policies block flagged malware, but only on 2.10. A CI image running an old Composer version, or a project disabling the policy, still installs flagged versions.
Private Packagist now blocks these at the registry, on any client.
#php #phpc #composerphp

[Kim @thinkverse]

@leifthedog Hörde den precis och det var det första jag tänkte på!

[JFrog Security @JFrogSecurity]

🚨 Security Alert: Multiple Red Hat Cloud Services npm packages have been compromised in a new supply chain incident (@​redhat-cloud-services)

The embedded malware executes silently upon installation, targeting local environments to harvest sensitive CI/CD secrets and cloud access tokens.
We will share our full technical analysis blog post soon. Stay tuned. 🛡️

[Resend @resend]

We're hiring across Ops, and Engineering, Marketing.

Special attention: just opened 2 new roles on our Core Sending Squad:
- Backend Engineer (MTA)
- Deliverability Engineer

Who should we hire? 👇

[Socket @SocketSecurity]

Famous Chollima, the North Korean threat group known for fake job interview lures, appears to have used a PHP/Packagist package path in a targeted developer lure.

We found the loader in a compromised Laravel package, on a branch that could be installed through Composer. It was appended after a normal Tailwind config and used TRON, Aptos, and BNB Smart Chain RPC infrastructure to retrieve and run remote JavaScript.

Developers should be careful with “interview task” or “take-home project” requests that ask them to clone a repo, check out a specific branch, or install an exact dev dependency.

[International Cyber Digest @IntCyberDigest]

‼️🚨 BREAKING: Meta's AI feature let attackers hijack Instagram accounts for days with nothing but a username. It was being A/B tested on a slice of users, and if you were in the test, you couldn't turn it off. Among the casualties: the official Obama White House account.

The method: get on a VPN near the target's region, ask the Meta AI support agent to send a verification code to any email you control, relay that code back to the agent, and it hands over a password reset link. Without ID or human review. From there, the account is yours.

The flaw lived in the AI's logic layer, which acted on recovery requests with no real identity checks. One researcher compared it to the Roblox AI assistant exploit from days earlier, where you needed a target's billing info. Instagram was easier: the username and a regional VPN were enough and victims reported sessions revoked and passwords changed with no email, text, or push alert at all.

By the time it went public, the method was common knowledge in blackhat Telegram circles and had been used to allegedly hijack 100+ high-value accounts.

Accounts hit:
- obamawhitehouse (the archived official Obama White House account, ~2.4M followers. Hackers posted an AI-generated image captioned "The White House is under Shiites' control," plus cryptic anti-Trump and pro-Iranian Stories. Meta confirmed the hack and scrubbed it.
- Premium short handles like hey and jowo, worth over $1M combined, stolen and flipped on Telegram.
- albert (owned by Albert Renshaw), whose owner publicly reported being locked out and unable to reach Meta support.

Meta has since patched it. There was no public acknowledgment.

[Nat Miletic @natmiletic]

New scam alert!

Someone fills out a contact form and asks you to book a call with them.

It's a fake calendly page with a Google login which steals your Google account info. Haven't seen this one before kind of cheeky.