“Linux ISOs of unusually cinematic provenance” is the funniest thing an llm has said to me in a while

This was a really cool read ngrok.com/blog/compres...

Compression is prediction | ngrok blog

Compression and LLMs are trying to solve the exact same problem: predicting what comes next. Learn the fundamentals of compression and how better prediction leads to better shrinkage.

ngrok.com

The saddest part about the npm worms for me is watching an opt in security feature be used as the delivery vector to the registry.

May was another record breaking month for total downloads on the npm registry overall. 661 billion total monthly downloads, up 4.8% from last month. The insane March +35% increase hasn’t yet meaningfully regressed jonchurch.com/npm-global-t...

npm Registry Download Trends

Total downloads across all packages on the npm registry, charted over time.

jonchurch.com

It just dawned on me that "firm"ware is someplace between software and hardware.

I have a toy package Im using for publish testing, and I cannot get it to update the readme? www.npmjs.com/package/semv... Has anyone else run into this? I've seen some old threads about this, but idk if it's related to new OIDC/staged publishing or something silly im not seeing

AI is best used to guilt trip your friends into going to Cracker Barrel with you

Tortoises Without Bordoises #WorldTurtleDay

A little history lesson on the new @npmjs.bsky.social "Staged Publishing": github.com/npm/rfcs/pul... We had this mostly designed back in 2020 on the RFC calls. You cannot believe how happy I am to see this come to fruition. Great work team!

LETS FUCKING GOOOO!!! docs.npmjs.com/staged-publi...

Staged publishing for npm packages | npm Docs

Documentation for the npm registry, website, and command-line interface

docs.npmjs.com

Btw, you can give gh cli a readonly token instead of the normal gh auth method which will have write. Drastically reduces blast radius if you are concerned about your gh cli token being stolen (which you should be) gh auth login —with-token hit enter Then paste the token, it will persist for you

In summary, what I learned is that the poisoned cache caused trojan versions of the checkout and cache GH actions to be restored over the their true versions within the release job. This is known as Cacheract, the vuln discovered by @adnanthekhan.bsky.social github.com/AdnaneKhan/C...

GitHub - AdnaneKhan/Cacheract: GitHub Actions Cache Native Malware - for Educational and Research Purposes only.

GitHub Actions Cache Native Malware - for Educational and Research Purposes only. - AdnaneKhan/Cacheract

github.com

jonchurch@jonchurch.com · 3mo ago

Does anyone have a link to an in depth write up of the tanstack attack, the CI compromise bit? I ask bc I am doing my own analysis and the official post mortem doesnt seem to get all the details right. That or I am misunderstanding something, so want to see if a real expert has written this up

Does anyone have a link to an in depth write up of the tanstack attack, the CI compromise bit? I ask bc I am doing my own analysis and the official post mortem doesnt seem to get all the details right. That or I am misunderstanding something, so want to see if a real expert has written this up

Okay so adding cache to the list of github actions feature surface to always be terrified of adnanthekhan.com/posts/clinej...

Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager | Adnan Khan - Security Research

Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager - Security research by adnanthekhan

adnanthekhan.com

tbh I didnt know whoopi was still on The View

There is no Trusted Publishing setup which prevents a compromised repo admin's github PAT from triggering an npm publish, right? I've spent months trying to find something, but deploy envs w/ required reviews, workflow guards, branch protections, signed tags. All of it can be overwritten w/o 2fa

devEngines started as @geoffreybooth.bsky.social and I in DMs 2 years ago. It's now supported in @npmjs.bsky.social & @pnpm.io, and later this month will be our recommended way for developers at Netflix to define runtime and package manager versions in their projects. docs.npmjs.com/cli/v11/conf...

package.json | npm Docs

Specifics of npm's package.json handling

docs.npmjs.com

Rebranding the bullet point fetish of llms "bullet pontification"

added OG image to my little npm reg total download trend site, so here's a reminder to keep an eye on this, hopefully one day we find out why exactly downloads have exploded! No idea if its agents (sandboxes), security scanning companies, or model training ¯\_(ツ)_/¯ jonchurch.com/npm-global-t...

npm Registry Download Trends

Total downloads across all packages on the npm registry, charted over time.

jonchurch.com

So... we've decided to change things up. NodeConf EU 2026 will be hosted in Bologna, Italy this year. The dates are set for September 29th and 30th, 2026.

Theres been an npmx bug that’s bothered me for a few weeks now. User profiles are showing almost random packages. Its a subset of your packages, first I thought it was dropping anything in an npm org dug a little and it was worse. It shows packages _where the gh user is the same as the npm user_

🪿 There are some wild takes out there right now about open source being “dead” after recent supply chain attacks and rapid advances in AI-driven security. Let’s talk goosenomics for a minute. → socket.dev/blog/dont-ki...

Don't Kill the Goose That Lays the Golden Eggs - Socket

Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three dec...

socket.dev

jokes on them, ignoring my inbox has long been part of my security posture

Socket@socket.dev · 4mo ago

🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week. socket.dev/blog/attacke...

We released a lodash patch today, everything went well so havent really thought about it since. A non event. Released a minor yesterday, and it broke stuff and immediately heard about it. Couldnt stop thinking about it until we fixed it EoD today 🫠

Okay so adding cache to the list of github actions feature surface to always be terrified of adnanthekhan.com/posts/clinej...

Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager | Adnan Khan - Security Research

Clinejection — Compromising Cline's Production Releases just by Prompting an Issue Triager - Security research by adnanthekhan

adnanthekhan.com

belt-and-suspenders

lodash just had its first ever 100M+ download week on npm that's a 70% YoY increase

its frustrating that the remote claude code env is missing some tools. For me its the missing gh cli that really hurts, for reading issues/PRs or otherwise doing read against GH So I created this StartSession script which ensures it is installed in remote sessions www.npmjs.com/package/@jon...

i do like the computer

In my OSS archaelogy efforts I keep bumping into the defunct Component.js pre-npm registry and UI framework paradigm Just found this video explainer from their homepage focusing on the ui component runtime system, really capturing a point in time www.youtube.com/watch?v=gtz7...

ComponentJS - 1 - Overview

YouTube video by Dr. Ralf S. Engelschall

youtube.com