frontpage.
newsnewestaskshowjobs

Open Source @Github

fp.

Open in hackernews

Building my npx business card

https://ashley.dev/posts/turning-feedback-into-features/
8•edent•1y ago

Comments

steele•1y ago
Ooh, free real estate, let's colonize and gentrify package management
aabhay•1y ago
Lmao, gentrify cracked me up
neilv•1y ago
Do these npx business cards run arbitrary code on your computer?
cypherpunks01•1y ago
npx

Run a command from a local or remote npm package

Description

This command allows you to run an arbitrary command from an npm package (either one installed locally, or fetched remotely), in a similar context as running it via npm run.

neilv•1y ago
Yes, then is a "command from an npm package" arbitrary code?

And what is this "similar context as running it via npm run"?

Would it be better to answer the question directly?

joshka•1y ago
Yeah, this seems like a very smart but inherently flawed idea.
cypherpunks01•1y ago
Yes I agree! OSS package management ecosystems are a great idea, but allowing submissions without any review or vetting is just asking for supply chain attacks.
Xss3•1y ago
May as well just release an executable tbh.
theamk•1y ago
Reminds me of JAPH [0] - a tiny Perl program that was used in email/newsgroup signature to give it personal touch.

[0] https://www.perlmonks.org/?node_id=412464

watusername•1y ago
Terminal business cards are a nice idea, but RCE business cards are just asking for trouble. Instead of npx, what happened to good'ol curl? Something like

$ curl ashley.dev

Some decades ago, we had finger (https://en.wikipedia.org/wiki/Finger_%28protocol%29) which is designed for this very use case. Sadly it's no longer installed by default with most distros:

$ finger @ashley.dev

queezey•1y ago
This would be a great advertisement for security consulting.

"I was just able to run arbitrary code on your computer. Here is a sample of your recent browser history. Let me tell you help you mitigate your security vulnerabilities."

AI is forcing us to pay off 40 years of technical debt

https://spectrum.ieee.org/ai-in-cybersecurity-php2shell-vulnerability
682•pseudolus•6h ago•437 comments

Progress on provable inference for large language models

https://www.anthropic.com/research/provable-inference
37•ltononro•35m ago•14 comments

Guerrilla bike lanes: San Francisco makes illicit infrastructure permanent (2016)

https://99percentinvisible.org/article/guerrilla-bike-lanes-san-francisco-makes-illicit-infrastru...
128•zenincognito•2h ago•56 comments

Nvidia RTX Spark encrypted firmware slows inference speed to 35% on Linux

https://www.mindstudio.ai/blog/linux-nvidia-rtx-spark-laptop
448•novaRom•9h ago•197 comments

An end to buggy web apps

https://replay.io/blog/an-end-to-buggy-web-apps
26•bhackett•51m ago•16 comments

North Korean fake job interview led to $6.3B Binance heist

https://www.theregister.com/security/2026/11/03/north-korean-fake-job-interview-led-to-63b-binanc...
346•smalltech•3h ago•213 comments

AMD expects to outsell Intel in Q4 for the first time in history

https://www.tomshardware.com/pc-components/cpus/amd-expects-to-outsell-intel-in-q4-for-the-first-...
158•rbanffy•2h ago•49 comments

Show HN: I built a tool that prices a prebuilt PC part by part

https://pcdealcheck.com/
32•adlep•2h ago•8 comments

Verification Is Not Knowledge: Science needs more than answers

https://blog.cosmos-institute.org/p/verification-is-not-knowledge
180•ersinesen•8h ago•103 comments

Launch HN: Kino AI (YC S23) – AI media manager and video editor

2•lukeigel•20m ago•0 comments

Kimi K3.1 Pro model weights are out

https://huggingface.co/moonshotai/Kimi-K3.1-Pro
129•abrarthought•2h ago•20 comments

Tell HN: Gemini trains on chat history, even for subscribers (personal accounts)

459•jameslk•7h ago•123 comments

Incident with Pull Requests, Git Operations and Issues

https://www.githubstatus.com/incidents/smtdswd1h2w4
206•kevcampb•7h ago•108 comments

Letting users trust their own MCP clients, without opening a phishing hole

https://streamvessel.com/blog/mcp-trusted-redirect-uris
22•isalexlog•2h ago•2 comments

Jelly Sheet

https://mrdoob.github.io/codevember-2026/01/
396•memalign•14h ago•104 comments

Adding Window Functions to a Spreadsheet

https://www.getgrist.com/blog/running-totals-you-dont-have-to-chase/
27•reedciccio•2h ago•19 comments

Show HN: Codemap – one-page interactive map of any Go repository

https://github.com/peterretief/codemap
27•peter_retief•2h ago•9 comments

Debian apt security update (man-in-the-middle)

https://lists.debian.org/debian-security-announce/2026/msg00526.html?pow_referer=
81•SG-•2h ago•16 comments

Kitty 0.50

https://sw.kovidgoyal.net/kitty/changelog/#
303•porridgeraisin•8h ago•194 comments

Evergreen: A Provably Safe Systems Language

https://evergreenlang.net
58•jordan_bonecut•2h ago•44 comments

Tencent Hy4

https://hy.tencent.ai/research/hy4
26•Philpax•3h ago•1 comments

Stringman, an $800 open-source room scale gripper robot

https://neufangled.com/
744•nharada•1d ago•228 comments

Mocktastic: A Meshtastic Node on Arduino

https://github.com/Vapmuz/Mocktastic
19•kimi•4h ago•1 comments

The Internals of PostgreSQL

https://www.interdb.jp/pg/index.html
349•ibobev•20h ago•27 comments

Pierre Computer is being acquired by OpenAI

https://twitter.com/pierrecomputer/status/2117999036175188183
52•itunpredictable•2h ago•22 comments

The lost malloc()

https://napcakes.nekoweb.org/posts/malloc/
127•matt_d•10h ago•48 comments

Synaptics Appears to Use Legal Threats to Block Open-Source DisplayLink Driver

https://www.phoronix.com/news/Synaptics-Blocks-Vino-Driver
142•snvzz•6h ago•57 comments

Giant canyon on Mars is still tectonically active

https://lamont.columbia.edu/news/giant-canyon-mars-still-tectonically-active-today
134•gmays•16h ago•34 comments

Show HN: HackerTV – HN's most-recommended Youtube videos as 24/7 TV channels

https://hackertv.org
424•dsalzman•1d ago•78 comments

Show HN: Uncracked City, detective game where you question LLM suspects that lie

https://uncracked.city
115•passkey1510•20h ago•56 comments