Must ... refrain... from logging in... during holiday... one more day. Good luck to anyone in/affected 🫂

Socket@socket.dev · yesterday

🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all affected packages/versions.

"The data shows that many engineers spend in the range of hundreds of dollars a month to a few thousand dollars in tokens," um, wait. they call that tokenmaxxing at microsoft? wow, like they weren't even trying. lol slashdot.org/story/26/08/...

Still working out some kinks. Like explaining to claude how a catapult actually works. It's funny because it seems to understand that concept, it basically built all of this, has access to canvas and dom and what not. But still I have to holds its hand. Many times over.

I think the problem with my vacation mode claude setup was that the outer loop (which restarted the session) worked fine, but the task instruction mechanism would force a restart too often, leading to the overhead sucking up my quota. Need the shell script to read/write to the active CLI session...

I've tried to read a few chess books in my vacation. I find them really difficult and the style of these books is just not for me. They all claim to be beginner-ish books but go off on long lines. Sorry, my millennial brain has no patience to replay them on an actual board. I need pics.

"Please speed up the app" Goes from 4/s to 40/s "Use the builtin nodejs profiler to determine whether you can speed up the core computation" Goes from 40/s to 400/s

How it started...

That moment when you see you have plenty of Claude budget for 10 more minutes and you crash some fable prompts into it to maxxxx the void and come to realize that the reset is stated at 10pm UTC and you're actually on CEST. Which is not the same. fehhhh.

This is a big deal. It kills like 99% of all npm malware we see today. Give or take. It won't go away. Of course. But it helps.

Socket@socket.dev · 4w ago

🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs

"great win!" - hung my queen in move 6 - opponent timed out at move 10 pfff. never give up and all that but

not sure about kimi's output there but close enough. I think gpt's output also refers to me but not entirely sure. if not, that would be a bit of a curious coincidence.

ok, gartner. great ... "journalism" you got going there 🙄

Hey AI make this thing go faster. It takes 15min for this case and that's just slow. I set 10min as goal to keep it going. AI: it's too tough, can't do it * cuts off 90s AI: now it's really too tough, can't do it * cuts off 80s AI: that's really it * cuts to under 10min AI: ok, all done Me: wtf?

Asserted dominance by defeating both my kids at chess. Despite hanging my queen in both occasions 🙈. One even tricked me in doing so! They'll get me eventually. Just let me have this.

It's fine to be skeptical against AI generated code. It's fine to block it from your repo because it's too noisy or commonly has quality problems or whatever. It's probably true. But to state that it's "invariably garbage" just _destroys_ your credibility. Why would you do that. Who hurt you?

Me: why does my wishlist seem to be growing all the time... Also me: 80% discount? Hmmm, nah. Not yet.

"Perfect randomness". Some years ago they would probably call that "Pure magic". In some years they'll call it "Primary school education" or "duh". I don't believe in factual randomness. We just don't know how it works, yet.

@baggerspion.bsky.social open up your dms you doodoo

An aspect I like about current code assists is the freeform that still just works. You can dump large debug blobs and say "fix this" before it or after it and it can distinct the mechanical output from the user request. And it works in various contexts, very efficiently. Almost flawlessly so.

I want a `git lock` which locks the git status to a read-only state under a pincode. Goal is to allow an AI to read the state but not to make changes to it. They're too snap happy to just checkout or commit or whatever and I don't have an easy way of allowing read-only only. Any tips?

Rest of my Sunday is cooking

More like breaking my Sunday afternoon. So what I don't get having done this research is: why would an actor go through all this trouble only to put their malware research and code PUBLIC together WITH the actual c2 infra. Like, wtf? You can't be stupid to have come this far. But at the same time...

Socket@socket.dev · 2mo ago

🚨 BREAKING: Active supply chain attack across npm, PyPI, and Crates.​io. Socket detected TrapDoor, a crypto stealer campaign hitting 34 malicious packages and 384 versions and artifacts, with attackers repeatedly pushing new releases across ecosystems. socket.dev/blog/trapdoo...

Weee are night and day 🎵

I'm not sure how we're not going to have a mass forced credential roll at this point tbh. github, aws, gcp, ai vendors, and anything in between should just force a roll event of credentials on their customers, sooner than later. disruptive? yes. but so is getting hacked. so...

Socket raised a C round! (Maybe we should be SoCket now! ok eeew no) All I can see on my part is that I've been having an awesome time working on AI and with AI, detection, and what not. Lucky to be part in the right place at the right time :D bsky.app/profile/fero...

Feross@feross.bsky.social · 3mo ago

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

'using' is probably the biggest change in a while that will be visible in code bases very quickly. It's just sugar but I like it, slightly awkward keyword notwithstanding

Rob Palmer@robpalmer.bsky.social · 3mo ago

ECMAScript excitement 😉 Congrats to @chronicles.org on meeting the conditions for Explicit Resource Management to be Stage 4 at @tc39.es today 🎉 It introduces `using` declarations and the Symbol.dispose protocol to deterministically and ergonomically release resources 👍 github.com/tc39/proposa...

I wish these llm benchmarks would include a chess elo :D

Works or b0rks? ``` console.log(delete undefined); console.log(delete null); ```

Was a good morning to roll out our @socket.dev firewall integration which had these packages blocked in ~6min from publish.

Feross@feross.bsky.social · 3mo ago

🚨 Active supply chain attack on TanStack. 84 npm packages compromised, including react-router (12M+ weekly downloads). The malware is a self-propagating worm: steals GitHub Actions OIDC tokens, republishes itself to npm as the compromised maintainer. Socket flagged every version within 6 minutes.

This phrasing makes sense to me tbh

Jay@jaygeorge-uk.bsky.social · 3mo ago

A great article by @addyosmani.bsky.social addyosmani.com/blog/cogniti... Offload; don't surrender. "Cognitive offloading is delegating to the AI and still owning the answer. Cognitive surrender is when the AI’s output quietly becomes your output and there is nothing you feel is left to check."