15:I[981,["658","static/chunks/658-a698693f56d0116a.js","183","static/chunks/183-6beeeb801c274aaa.js","474","static/chunks/app/%5Btype%5D/layout-e8e83705b5c8d3b7.js"],"Posts"] 16:T42b,https://npm-supply-chain-attack-techniques.pagey.site/attack...

Website: https://npm-supply-chain-attack-techniques.pagey.site

This covers all techniques used in past 1 year to conduct various attacks on npm packages. Use it to get your project reviewed thoroughly before publishing.

Exploits covered with mitigation information:

1. Maintainer Account Takeover and Malicious Publish

2. Lifecycle Hook Execution

3. Self-Replicating npm Worms

4. CI/CD Identity Plane Attacks

5. Git-Based Dependency Smuggling

6. Remote Dynamic Dependencies

7. Phishing Infrastructure Hosted Through npm and Package CDNs

8. Credential and Secret Harvesting

9. Exfiltration and Dead-Drop Channels

10. Persistence and Anti-Forensics

11. Obfuscation and Payload Packaging

12. Package Naming and Discovery Abuse17:T62a,A few things kind of aligned over the last month. I'd been wanting to try pi.dev (https://pi.dev), DeepSeek has a very aggressive 75% discount on their v4-pro model until end of May, and I had this old itch from my LFS days to "do my own thing" with POSIX utilities.

So I set up to do an experimental project with strict architectural rules, pointed an LLM at it, and fed it the BusyBox test suite as ground truth.

The result: 77 POSIX utilities in pure Go, single static binary (~10MB), and it passes 548 of 552 BusyBox tests.

My Honest take: this project is ~90% wiring the AI to do the heavy lifting, ~10% steering it in the right direction. Took about 3 weeks of "prompts" and plans and al

We Got a CISA GitHub Leak Taken Down in Under a Day

Istio 1.30.0 (Including Agentgateway)

India's hottest district shuts at 10 am as mercury breaches 48 C mark

Personal AI for your real life. – Maple

Gelatine Sculpt and the Viral Gelatin Trick for Weight Loss

Bubbles: Blog Post Discovery

Solo Founder creating something for other Founders

Aspirations and Inequality (2017) [pdf]

Systems Are Changing: The Architect's Role in the Era of Agentic Co-Design

Werkstattprosa

A new whale detection network launches in SF Bay, alerting ships in real time

Code-Specify-Test-Debug-Prove: Flexibly Integrating Separation Logic [pdf]

Testing MiniMax M2.7 via API on three real ML and coding workflows

Show HN: FpgacapZero on BRS-100-GW1NR9 dev board

Applying for Funding Is Exhausting

Manhattan Distance or Taxicab Geometry

FriendHike – Find hiking buddies near you

The Wedge Was After the Form Response

Show HN: Give This Markdown to Your Coding Agent Before Publishing to NPM

Deel's "Accelerate or Die" Moment

Claude is telling users to go to sleep mid-session and nobody understands why

CNN: 'Russia is losing in Ukraine. China has noticed – Trump should too'

Trying to figure out what Claude is helping in?

Practice Guide for Computer [pdf]

HN: SteelSpine replay tool for debugging AI agents

Hiring | AI Automation Engineer | Remote

Show HN: GoPOSIX – a Go-native POSIX userland, ~97% BusyBox-compatible

Autonomous Multi-Agent Cyber Defense

Vance tells anti-immigration protesters in the UK to 'keep on going'

LLM Wiki v2

Show HN: Git-chain – Simplify branch dependency management in Git

Comments