Bullder - Bitcoin | Lightning | Bitcoin class of 2140
Luis Alves
Joined July 2015
- Tweets13.6K
- Following5.2K
- Followers1.3K
- Likes16.4K
Talvez seja por isso que a galera tá animada no Twitter. Quem comprou SIM barato precisa de gente comprando pra desovar sem destruir o book. Vão esperar virar 0 ou 1 ou buscam saída? Tô pouco me fudendo pro resultado, só não quero leigo entrando por causa de print e se ferrando.
HASHRATE retweeted
🤨 People keep asking how to protect yourself.
#1: set min-release-age=7 in .npmrc
#2: install Socket for GitHub (it's free!) to protect PRs from bad dependencies: socket.dev/features/github
#3: install Socket Firewall (also free!) to protect your laptop: socket.dev/features/firewall
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
Todo dia isso agora pqp
do you understand what just happened to one of the most used npm packages on the internet?
→ axios gets downloaded over 100 million times a week and today it got compromised
→ an attacker hijacked the npm credentials of a lead axios maintainer… changed the account email to an anonymous ProtonMail address… and manually published two poisoned versions
→ [email protected] and [email protected]… neither version contains a single line of malicious code inside axios itself. instead they inject a fake dependency called plain-crypto-js that drops a remote access trojan on your machine
→ the fake dependency was staged 18 hours in advance… three separate payloads were pre-built for macOS, Windows, and Linux… both release branches were hit within 39 minutes. every trace was designed to self-destruct after execution too
→ there’s no tag in the axios GitHub repo for 1.14.1. it was published outside the normal release process entirely... bypassed CI/CD completely
→ StepSecurity called it one of the most operationally sophisticated supply chain attacks ever against a top 10 npm package
→ a routine npm install silently opens a backdoor… no warning… no suspicious code visible in axios itself
this is the wake up call all vibe coding bros need to hear right now:
→ if you installed either version… assume your system is compromised
→ pin to [email protected] or [email protected]
→ rotate all secrets, API keys, SSH keys, and credentials on affected machines
→ check network logs for C2 connections
→ add –ignore-scripts to CI npm installs going forward
100 million weekly downloads and one compromised maintainer account…
that’s all it took to wreak absolute havoc
and I imagine we see a whole lot more of these… crazy times ahead for cybersecurity and vibe coding
be safe out there y’all
HASHRATE retweeted
Software horror: litellm PyPI supply chain attack.
Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.
LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.
Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.
Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.
Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.
HASHRATE retweeted
A lot of cool plugins are launching every day. Don’t forget to leave a review at plugin-builder.btcpayserver.… and help make the plugin ecosystem stronger!
🚀 Plugin Directory: Telegram Shopping Bot plugin by @SolutionsNisaba is now listed.
This plugin allows merchants to create a Telegram Bot and synchronize their BTCPay point-of-sale systems with it.
HASHRATE retweeted
ANNOUNCING RailsX:
The most powerful tool for financial access, advancing Bitcoin's core principles of sovereignty and decentralization.
RailsX empowers peer-to-peer (P2P) trading with Lightning, enabling KYC-free, trading P2P in self-custody. Lightning is a now a DEX.
⚡️🧵
今日は悲しい日だ。
暗号市場で150億ドル以上が清算された。
そのほとんどが、レバレッジをかけたシットコイン。
ちょっと聞きたい。
なんで3万ドルを取引所に入れて、
シットコインで3倍レバかけるの？
正気か？💀
レバレッジは悪じゃない。
本当の危険はポジションの大きさだ。
自分のアイデアを信じるなら、
本物の資金で支えろ。
フェラーリサイズのポジションにシボレーの証拠金じゃ持たない。
ポジションが自分の総資産の範囲内なら、
君はレバレッジをかけてない。
ただのポジショニングだ。
リスク管理とは、資産の2%を失っても眠れること。
眠れなくなるのは管理じゃなく、ギャンブルだ。
History being made
The first stablecoin on Taproot Assets with practical Lightning Network integration is DePix, launched in November 2024 by Joltz and Eulen. It's native, enables instant transactions and swaps for BTC Lightning using the stable (pegged to BRL) via apps like Joltz SDK. It's fully functional, not just an announcement.
HASHRATE retweeted
O melhor programa de Bitcoin para devs está com inscrições abertas!
O futuro do Bitcoin precisa de você. ⚡
O Bitcoin Dev Launchpad é gratuito, intensivo e já transformou a carreira de dezenas de devs.
📅 Inscrições até 01/10: vinteum.org/bdl
