15:I[981,["658","static/chunks/658-a698693f56d0116a.js","183","static/chunks/183-6beeeb801c274aaa.js","474","static/chunks/app/%5Btype%5D/layout-e8e83705b5c8d3b7.js"],"Posts"] 16:T42b,https://npm-supply-chain-attack-techniques.pagey.site/attack...

Website: https://npm-supply-chain-attack-techniques.pagey.site

This covers all techniques used in past 1 year to conduct various attacks on npm packages. Use it to get your project reviewed thoroughly before publishing.

Exploits covered with mitigation information:

1. Maintainer Account Takeover and Malicious Publish

2. Lifecycle Hook Execution

3. Self-Replicating npm Worms

4. CI/CD Identity Plane Attacks

5. Git-Based Dependency Smuggling

6. Remote Dynamic Dependencies

7. Phishing Infrastructure Hosted Through npm and Package CDNs

8. Credential and Secret Harvesting

9. Exfiltration and Dead-Drop Channels

10. Persistence and Anti-Forensics

11. Obfuscation and Payload Packaging

12. Package Naming and Discovery Abuse17:T62a,A few things kind of aligned over the last month. I'd been wanting to try pi.dev (https://pi.dev), DeepSeek has a very aggressive 75% discount on their v4-pro model until end of May, and I had this old itch from my LFS days to "do my own thing" with POSIX utilities.

So I set up to do an experimental project with strict architectural rules, pointed an LLM at it, and fed it the BusyBox test suite as ground truth.

The result: 77 POSIX utilities in pure Go, single static binary (~10MB), and it passes 548 of 552 BusyBox tests.

My Honest take: this project is ~90% wiring the AI to do the heavy lifting, ~10% steering it in the right direction. Took about 3 weeks of "prompts" and plans and al

Applying for Funding Is Exhausting

Manhattan Distance or Taxicab Geometry

FriendHike – Find hiking buddies near you

The Wedge Was After the Form Response

Show HN: Give This Markdown to Your Coding Agent Before Publishing to NPM

Deel's "Accelerate or Die" Moment

Claude is telling users to go to sleep mid-session and nobody understands why

CNN: 'Russia is losing in Ukraine. China has noticed – Trump should too'

Trying to figure out what Claude is helping in?

Practice Guide for Computer [pdf]

HN: SteelSpine replay tool for debugging AI agents

Hiring | AI Automation Engineer | Remote

Show HN: GoPOSIX – a Go-native POSIX userland, ~97% BusyBox-compatible

Autonomous Multi-Agent Cyber Defense

Vance tells anti-immigration protesters in the UK to 'keep on going'

LLM Wiki v2

Ask HN: How does everyone talk about their work when they've used AI?

Even by Trumpian standards, a $1.8B fund for friends is bad

GitHub Compromised

Ask HN: How to manage AI APIs for SaaS application?

More Stupid Medium Stats Tricks

Your Slop, My Sludge

Fast Factorial Algorithms

OpenAI commits S$300M to grow Singapore's AI capabilities

List of Consumer Reporting Companies [pdf]

Alternatives for the EDIT tool of LLM agents

Google to release first smart glasses since Google Glass flop

Positive Alignment: Artificial Intelligence for Human Flourishing

I Asked ChatGPT to Manage a Stock Portfolio

Slap Links – A Chrome extension inspired by SlapMac

Ask HN: How to manage AI APIs for SaaS application?

Comments

Applying for Funding Is Exhausting

Manhattan Distance or Taxicab Geometry

FriendHike – Find hiking buddies near you

The Wedge Was After the Form Response

Show HN: Give This Markdown to Your Coding Agent Before Publishing to NPM

Deel's "Accelerate or Die" Moment

Claude is telling users to go to sleep mid-session and nobody understands why

CNN: 'Russia is losing in Ukraine. China has noticed – Trump should too'

Trying to figure out what Claude is helping in?

Practice Guide for Computer [pdf]

HN: SteelSpine replay tool for debugging AI agents

Hiring | AI Automation Engineer | Remote

Show HN: GoPOSIX – a Go-native POSIX userland, ~97% BusyBox-compatible

Autonomous Multi-Agent Cyber Defense

Vance tells anti-immigration protesters in the UK to 'keep on going'

LLM Wiki v2

Ask HN: How does everyone talk about their work when they've used AI?

Even by Trumpian standards, a $1.8B fund for friends is bad

GitHub Compromised

Ask HN: How to manage AI APIs for SaaS application?

More Stupid Medium Stats Tricks

Your Slop, My Sludge

Fast Factorial Algorithms

OpenAI commits S$300M to grow Singapore's AI capabilities

List of Consumer Reporting Companies [pdf]

Alternatives for the EDIT tool of LLM agents

Google to release first smart glasses since Google Glass flop

Positive Alignment: Artificial Intelligence for Human Flourishing

I Asked ChatGPT to Manage a Stock Portfolio

Slap Links – A Chrome extension inspired by SlapMac