Another day, another NPM worm: https://www.stepsecurity.io/blog/chaindrop-npm-worm

ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurity

A self-propagating worm is publishing compromised versions of dozens of npm packages using stolen maintainer credentials. See the affected packages and what to do now.

stepsecurity.io

My cancellable take is that `curl whatever | bash` isn't meaningfully worse than all the other awful ways of installing software that are deemed okay by the greybeards

This was mentioned on the most recent Retronauts community podcast but I'll announce it here in formal text mode: I will return to the Retronauts site in August with a new project! The Sega Master System Directory begins August 4th 2026 and CONTINUES WEEKLY UNTIL IT'S DONE. Every. Goddamn. Game!

RE: https://post.lurk.org/@sean_ae/117031646713034273 okay fellas but the robot hellbeast centaur does look pretty damn dangerous as it is

Craic ar dóigh sa Fleadh Cheoil na hÉireann le @antainemacaoidh #mastodaoine

it's called bisexuality (by ShaneValShane on YouTube)

people fear she may be ricing again #niri #noctalia

@gamemakerstoolkit.com I'd already given up dashes, and now it's coming for my teal??

The thing about a lot of modern fandom theorizing is they tend to proceed from the assumption that everything except the music is diegetic (sometimes even the music), and that can easily be thrown off by what's honestly pretty basic 4th wall breaking and metafictional shenanigans. Like, for […]

We are planning to release new Mastodon security updates for versions 4.4, 4.5, 4.6 and nightly this Monday, Jul 27, at around 14:00 UTC. It solves two major security issues. We encourage server administrators to plan for an update in the hours following the release to ensure their instance is […]

As a Sign Nerd, it's very nice to see that the Department for Infrastructure in Northern Ireland has gone with the Scottish model for bilingual traffic signs, and is using colour to differentiate languages. The initial mockups used italics (in the wrong typeface!) […] [Original post on tech.lgbt]

This is how Micron ships one (1) warranty replacement NVMe SSD. €1 coin for scale.

my number one tip: the moment something starts smelling a little "off" is the moment you must appear to be a Paper Trail Person. any time you speak on the phone with someone, they should get an email summary of the call from you within minutes with specific details of what they agreed to do/not do

taber@kvetch.gay · 2w ago

an extremely useful life skill is knowing how to subtly telegraph in your actions and interactions with officials, without ever saying so directly, that should they stray from the correct course of action, you are well-prepared to Become A Problem

The existence of an oubliette implies the existence of a larger, more masculine, less constricting oubli.

Wildly in need of a parental visit panic button that flips around all the smutty gay art to reveal serene impressionist landscape paintings

This is a Guinan Appreciation Zone

Brighton Bear Weekend with @antainemacaoidh. Not sure who thought to schedule a bear weekend in the middle of a heatwave

I'm sorry, but I just have not come around to the asterism ⁂ as a 'fediverse logo'. Either you put it in an image (in which case you could have used the actual logo that _already exists_), or you accept that it's going to be tofu for at least some people. I've never seen the whole 'dingbats […]

This is perfect! (By Amadeo Capelli) #mechanical #craft #art

Sainsbury's really came for beetroot with these descriptions

The law locks up the man or woman Who steals the goose from off the common But leaves the greater villain loose Who does not think to value goose #goose

You're not supposed to use the 2-in-1 shampoo because it violates the Unix philosophy

Taber -- @kvetch.gay -- all round great guy and fellow Person Getting Around on Bicycles, got doored and got pretty damn fucked up as a result. You can help out by donating to his recovery Gofundme here: https://www.gofundme.com/f/help-taber-recover-from-traumatic-brain-injury #MutualAid […]

Getting my desktop set up on an old laptop while I navigate RMAing the SSD from my Framework, I figured I'd give #Noctalia's v5 alpha a go alongside my usual #Niri, since Quickshell might be a bit hard on this slightly more mature hardware. I've gotta say, it's […] [Original post on tech.lgbt]

RE: https://timetheft.social/@tinybird/116793778709110728 happy pride

Ugh, my warranty replacement Crucial SSD is now, in turn, also dead after ~6 months. Their support still exists, but I can't imagine it's gonna be well staffed at this point

Monzo convinced that I teleported to Denmark for an hour when I bought some tea at Søstrene Grene in Belfast

RE: https://mastodon.social/@magicalgirlsabrina/116769248801161089 we're in fergatory

trying no to wake the neighbours but these ermine moths are just too c*nty