Shreyash

Software Engineer | Full-Stack | AI and Machine Learning

Building something that excites me 🔥

[Shreyash @WebDevCaptain]

Hi @aajtak @ABPNews @news24tvchannel @News18India @ZeeNews @ndtvindia @timesofindia

[NEXTA @nexta_tv]

📺 “We reported events one-sidedly for years”: Serbian TV apologizes to viewers after Vučić's party loses the election

Radio Television of Vojvodina (RTV) opened its news broadcast with footage of celebrations following the Student List's election victory — scenes it had failed to show the previous evening.

“For years, we failed to fulfill our duty. We kept silent, turned a blind eye, reported events one-sidedly, and failed to ask the necessary questions. For that, we owe our viewers an apology,” news anchor Goran Eror said.

Following the controversy, RTV's acting editor-in-chief Nenad Čačić resigned.

A similar incident occurred in Hungary, where state television also apologized to viewers after Viktor Orbán's election defeat.

[Shreyash @WebDevCaptain]

@palkisu @EncalmIndia @airindia Dont worrry, be happpyy

We have UPI 🤣

[Ryan Dahl @rough__sea]

celld's otel with parquet files is so nice. literally an entire observability stack enabled with one flag. across multiple services with-in your worker app, queryable with duckdb.

when you have the right abstractions (workers programming model) things just click

[Shreyash @WebDevCaptain]

@abhisar_sharma @Akshita_N Have some shame @Akshita_N

[Shreyash @WebDevCaptain]

@rijhwanisheetal Alimony Research is pretty common these days 😂

[Shreyash @WebDevCaptain]

@gopakumj @bihar_police @samrat4bjp @PatnaPolice बोया पेड़ बबूल का तो आम कहाँ से होए

Aur lo ₹10k aur becho vote, aur isse man bhar jaye to religion aur caste pe de dena, jb mukhiya hi apraadhi hoga to Gundagardi to badhega hi

[Shreyash @WebDevCaptain]

@DishitaInCrypto @smtgpt @NischalShetty Fraudsters @NischalShetty @smtgpt

[Arpit Bhayani @arpit_bhayani]

A malicious release of LiteLLM on PyPI stole passwords and keys from machines, even if your code never used LiteLLM. Here is how it worked...

First, how it got in. The attacker added one line to the build config: `data = "cook"`. That line caused three extra files to be included in the package during the build. The public GitHub repository did not contain this line, so the source code looked clean. Only the published package was malicious.

Second, why it ran without being imported. Python has a feature where a `.pth` file in `site-packages` can execute code every time Python starts. The attacker added a `cook.pth` file containing a single line: `import cook`. From that point on, almost any Python process on the machine could trigger the stealer: your app, pip, your editor, or your CI jobs.

Third, what it stole. It went after almost every secret a developer machine might have:

- SSH keys and shell history
- AWS, Azure, GCP, k8s, and GitHub credentials
- Claude Code, Cursor, and Codex Keys
- Saved browser passwords
- Environment variables
- LLM API keys stored in a LiteLLM proxy database

Fourth, how it pushed data out. It encrypted everything so that only the attacker could decrypt it, then uploaded it to a `/healthcheck` URL, making the traffic look like a routine health check.

Turns out, we cannot trust the source repository alone.

We need to also, pin package versions (classic) with hashes, give new releases time to be scrutinized before adopting them, and inspect the actual artifacts you install.

Security is more critical than ever! The software supply chain is a different beast. You can audit every line in a repository and still end up running malicious code.

Interesting times.

[Shreyash @WebDevCaptain]

Hello @TheOfficialSBI @SBICard_Connect

Is it true ????

[Aseem Manchanda @aseemmanchanda]

Break: SBI confirms data Leak of its customers. #SBI Data Leak.

[Shreyash @WebDevCaptain]

@spadjay Kalyana Mantap Ground, Koramangala. (Probably the best in Koramangala)

[Shreyash @WebDevCaptain]

@niyatitrivedi1_ @grok This needs to be studied !!

[Sarah Drasner @sarah_edo]

We have presents for you! 🎁

- A new WebMCP Skill with best practices for security, development, & consequential flows

- WebMCP Types: TypeScript definitions, with type inference from InputSchema

Give em to your agent, it helps scaffold out WebMCP so fresh and so clean clean

[Shreyash @WebDevCaptain]

@VerdantiPride Dont become a political stooge after such achievements

[Manish Gill @mgill25]

I love how anpad BJP goons and some Silicon Valley right wing bros both got offended by this tweet.

Goes to show that having the ability to write code isn't the pinnacle of intellectual achievement.

People in tech need to get more into Humanities.

[Shreyash @WebDevCaptain]

@designwkarthick Try @pidotdev

[Shreyash @WebDevCaptain]

@rishikagupta__ @piyushgarg_dev Use Handy, the best OSS STT

[Shreyash @WebDevCaptain]

@ivanfioravanti Hardware and perf

[Shashi Tharoor @ShashiTharoor]

Thanks for teaching today’s youngsters many of the same lessons, Modiji!

[Shreyash @WebDevCaptain]

@AshutoshRanka @_pallavighosh Aunty, pange mt lo inse, aapke BJP payroll ki PDF na nikaal dey ye log, IIT wala hai ye 😂