This attack leveraged GitHub Actions Cache Poisoning.
Payload deployed here: https://t.co/TawmjgwdBB
It looks like it detonated here: https://t.co/Cfeoa4aSgo
@jakemor This is basically paying me to use specific skills
That being said -- If I dont have to actually interact with the service (the agent can sign up) as a prequalifier, that would be something I would play with
Tanner begged NPM to take down a squatted "tanstack" package that was being held ransom against him.
48 days later, it was compromised and shipped malware.
There is no excuse. NPM needs to make significant changes.
If @mercury would import my credit card transactions and then catagorize those underneath the CC payment, so that the budget insights showed *everything* id pay them an extra $240/yr
PSA for founders who ever plan to fundraise:
Do not publicly post revenue numbers, or unlabeled “growth graphs,” or retention figures.
This is a bad idea. Go read @matt_levine if you don’t know why.
@weareuplers@paulg I agree that CS education is in a pretty bad state, but theres way more to college than just the classes. Living on your own, going to parties, etc all contribute to a more rounded person
@MatthewParrott@nat_pop3333@MTSlive@MartinShkreli What do you mean it cures literally every problem?
I am 30yr old, and not overweight. What health issues would ozempic, or really any "peptide", help me with?
Biggest takeaway from this: 3rd-party Google OAuth Apps that request scopes beyond the basic info (name/user/profile pic) is a dangerous attack vector.
To safeguard your org from attacks like this, highly recommend asking your Google workspace admin to restrict "unconfigured third-party apps" to only be able to request basic info needed 👇
Here's the direct link to access that settings page: https://t.co/rmkazEcai7
h/t @matid for the pro-tip!
A really good test of engineers is how they deal with blockages. weirdly this shows in good frontend devs the most. give a few of them the same 6 endpoints and you'll see the difference in "speed"
it comes down to knowledge of state management, then http stuff
A 10-minute delay becomes a 24-hour delay by the end of the chain.
Say I reply 10 minutes late to an engineer in London.
He comes back an hour later, builds for two hours, and sends it to the product lead in New York at 6pm.
NY has a note, sends it back at 4pm EST - but London is asleep.
He wakes up, fixes it, and passes it to the team in SF.
It's midnight on the West Coast, so they open it the next morning.
One 10-minute delay. A full lost day.
Now flip it. I reply in 30 seconds and that same chain finishes in a few hours.
That expectation compounds - it spreads to your direct reports, then to theirs. Fast response culture doesn't just save time. It transforms how quickly the entire company moves.
This isn't about being glued to Slack 24/7. It's about treating unblocking as your highest priority. When someone is waiting on you to keep moving, that's the thing you do first. Not after lunch or after your next meeting - now. Because you're not just making one person wait. You're making everyone downstream wait.
Moving fast is about clearing hurdles - identifying what's blocking progress and getting it out of the way before it stalls the chain.
@elonmusk is the best at this. He built a culture of hurdle-clearing at his companies. And what's key is that he doesn't wait for problems to surface. He goes straight to the frontline, identifies bottlenecks, and removes them in order of priority.
That's the mindset. Don't wait for the perfect path. Clear what's in front of you and keep moving!