frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Building my npx business card

https://ashley.dev/posts/turning-feedback-into-features/
8•edent•1y ago

Comments

steele•1y ago
Ooh, free real estate, let's colonize and gentrify package management
aabhay•1y ago
Lmao, gentrify cracked me up
neilv•1y ago
Do these npx business cards run arbitrary code on your computer?
cypherpunks01•1y ago
npx

Run a command from a local or remote npm package

Description

This command allows you to run an arbitrary command from an npm package (either one installed locally, or fetched remotely), in a similar context as running it via npm run.

neilv•1y ago
Yes, then is a "command from an npm package" arbitrary code?

And what is this "similar context as running it via npm run"?

Would it be better to answer the question directly?

joshka•1y ago
Yeah, this seems like a very smart but inherently flawed idea.
cypherpunks01•1y ago
Yes I agree! OSS package management ecosystems are a great idea, but allowing submissions without any review or vetting is just asking for supply chain attacks.
Xss3•1y ago
May as well just release an executable tbh.
theamk•1y ago
Reminds me of JAPH [0] - a tiny Perl program that was used in email/newsgroup signature to give it personal touch.

[0] https://www.perlmonks.org/?node_id=412464

watusername•1y ago
Terminal business cards are a nice idea, but RCE business cards are just asking for trouble. Instead of npx, what happened to good'ol curl? Something like

$ curl ashley.dev

Some decades ago, we had finger (https://en.wikipedia.org/wiki/Finger_%28protocol%29) which is designed for this very use case. Sadly it's no longer installed by default with most distros:

$ finger @ashley.dev

queezey•1y ago
This would be a great advertisement for security consulting.

"I was just able to run arbitrary code on your computer. Here is a sample of your recent browser history. Let me tell you help you mitigate your security vulnerabilities."

Kitty 0.50

https://sw.kovidgoyal.net/kitty/changelog/#
111•porridgeraisin•1h ago•48 comments

Verification Is Not Knowledge: Science needs more than answers

https://blog.cosmos-institute.org/p/verification-is-not-knowledge
41•ersinesen•1h ago•17 comments

Nvidia DGX Spark encrypted firmware slows inference speed to 35% on Linux

https://www.mindstudio.ai/blog/linux-nvidia-rtx-spark-laptop
44•novaRom•1h ago•17 comments

Incident with Pull Requests, Git Operations and Issues

https://www.githubstatus.com/incidents/smtdswd1h2w4
21•kevcampb•25m ago•8 comments

Milkman – The Better Alternative to Postman

https://milkman.dev/
18•jplunien•1h ago•22 comments

Jelly Sheet

https://mrdoob.github.io/codevember-2026/01/
252•memalign•6h ago•68 comments

The lost malloc()

https://napcakes.nekoweb.org/posts/malloc/
49•matt_d•2h ago•8 comments

Jailbreaking my car's navigation system just so I can change the time

https://blog.nns.ee/2026/11/02/renault-hack/
822•xx_ns•1d ago•321 comments

Stringman, an $800 open-source room scale gripper robot

https://neufangled.com/
604•nharada•17h ago•200 comments

The Internals of PostgreSQL

https://www.interdb.jp/pg/index.html
283•ibobev•12h ago•22 comments

C++26 Disapproved

https://andreasfertig.com/blog/2026/11/cpp26-dis-failed-how-does-cpp-survive/
306•thatxliner•9h ago•197 comments

Show HN: Uncracked City, detective game where you question LLM suspects that lie

https://uncracked.city
65•passkey1510•13h ago•23 comments

Distinct cellular and genetic differences in colorectal cancer in young patients

https://www.dana-farber.org/newsroom/news-releases/2026/study-reveals-distinct-cellular-and-genet...
73•gmays•7h ago•18 comments

Giant canyon on Mars is still tectonically active

https://lamont.columbia.edu/news/giant-canyon-mars-still-tectonically-active-today
90•gmays•8h ago•13 comments

Osewa – An open-source alternative to SSH and Mosh

https://osewa.dev/
3•dkpk•50m ago•1 comments

Show HN: HackerTV – HN's most-recommended Youtube videos as 24/7 TV channels

https://hackertv.org
337•dsalzman•1d ago•68 comments

Fujifilm to boost tape production 5x as AI fuels archiving demand

https://arstechnica.com/gadgets/2026/10/fujifilm-to-boost-tape-production-5x-as-ai-fuels-archivin...
476•bookofjoe•1d ago•197 comments

Arrows to arrows, categories to queries (2025)

https://reasonablypolymorphic.com/blog/arrows-to-arrows/
55•firstbase•7h ago•2 comments

Japan's Jimi 'Mundane' Halloween Costumes of 2026

https://spoon-tamago.com/japan-jimi-mundane-halloween-costumes-2026/
192•zdw•2d ago•32 comments

Qwen 3.8 27B on my laptop can interpret model weights, too

https://simonwillison.net/2026/Nov/3/qwen-can-interpret-model-weights/
630•theanonymousone•16h ago•184 comments

Safari introduces Adaptive Dark Mode in 27.3

https://webkit.org/blog/18541/introducing-adaptive-dark-mode/
440•paddingtone•12h ago•228 comments

How I use AI (Oct 2026)

https://ben.stolovitz.com/posts/how-use-ai-oct-2026/
174•citelao•16h ago•176 comments

Postman silently auto-installs AI plugins and attempts to share all API data

https://github.com/postmanlabs/postman-app-support/issues/14370
1293•sidgarimella•17h ago•435 comments

We're training a Figma-fluent editing model

https://www.figma.com/blog/training-a-figma-fluent-editing-model/
121•gmays•3d ago•53 comments

There is no posttraining data commons

https://openathena.ai/blog/there-is-no-posttraining-data-commons/
75•lukasschwab•19h ago•22 comments

The Little Book of Generative AI Foundations: An Intuitive Mathematical Primer

https://arxiv.org/abs/2605.29713
343•ibobev•12h ago•53 comments

Why Clip Art Was Everywhere Until It Wasn't [video]

https://www.youtube.com/watch?v=XfLlpxE6AYM
39•surprisetalk•21h ago•15 comments

Show HN: Kairos – Open-source risk and fraud decisioning platform

https://github.com/finic-ai/kairos
93•ayanb9440•13h ago•23 comments

The 'Astra can read and write weights to improve Qwen' post is misleading

https://honnibal.dev/blog/astra-read-write-misleading
985•syllogism•22h ago•203 comments

Curiosity Traps

https://www.autodidacts.io/curiosity-traps/
79•surprisetalk•1d ago•12 comments