Jeff Morgan ([email protected]) retweeted
Jeff Morgan ([email protected]) retweeted
🚨 There's a major attack going on via npm right now.
Do not install any packages right now.
Talk to your agent ASAP and check if you're vulnerable or have been compromised.
This is urgent ‼️
‼️🚨 UPDATE: The TanStack npm attack is now a full campaign.
'Mini' Shai-Hulud has hit:
- OpenSearch
- Mistral AI
- Guardrails AI
-UiPath
- Squawk packages across npm and PyPI
The malware specifically targets AI developer tooling. It hooks into Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to re-execute on every tool event, long after the infected package is gone. npm uninstall does not fix this.
I turned Claude loose addressing the 53 high and medium priority issues and they were all patched and deployed the same day.
Please give it a try and let me know what you think.
github.com/cheezy/security-r…
The results? The new plugin found all 17 security related issues that the original plugin found. It also found 36 more totalling 53 high and medium severity. All of these issues were valid security concerns. It also found 56 items that it said were low severity. /6
After Claude built the first version of the plugin, I pointed it to some more sites that are focused on standards in the security profession and asked it to improve the plugin. /5
Now that it had a lot of information (much more knowledge than I possess on this topic), I asked Claude to build a Claude Plugin to run security scans against full codebases and also agains diffs for PRs. /4
I pointed Claude Code to numerous security related sites and databases. I also pointed it to sites that talked about techniques to find security vulnerabilities. /3
First thing Monday morning I decided to run the Anthropic security-review plugin agains one of my codebases. To my surprise, it found 17 security related issues. Not being satisfied with that, I decided to run an experiment. /2
Yesterday was an exciting day. Over the weekend I read an article that described the hardening that the Mozilla team did to Firefox with the help of Mythos (see first comment for link). It got me thinking a lot about security and how important it is now and in the future. /1
Replying to @housecor
Tidewave does this and a lot more. Check it out.
If you are looking for a place to watch the Champions League, there is a pub right across the street from the venue at 21 Harbour St.
If any attendee is interested in grabbing dinner and chatting about tech and ai specifically, I live directly next to the venue. Let's connect.
Claude plugin, copilot plugin, gemini plugin, all updated and published while drinking coffee at a cafe. Codex and opencode plugins will be finished before I leave. claude-remote FTW! #claude
Replying to @NDC_Conferences @shanselman
Welcome to Toronto. Hope you have a great time and reach out if you need some recommendations on fun things to do in the city.
Replying to @RYP__ @bpettichord
Now do it again but much larger this time.
Jeff Morgan ([email protected]) retweeted
We are Americans.
We are the most powerful nation on the planet.
What defines us is not our power to dominate the weak.
What demonstrates our character is not our capacity to traumatize the afflicted.
What speaks our truth is not how we taunt, deride or belittle the embattled, broken or battered.
We are:
The country of the Marshall Plan
The nation of The Berlin Airlift
The nation whose leader said, “Mr. Gorbachev, tear down this wall.”
We are at our best when we are resolute against evil -- not when we kowtow to those who perpetrate it.
We tell our truth when we defend the weak -- not when we do it only if we get protection money.
We are America when our leaders call the dictators dictators and those who fight to defend democracy against tyranny what they are: heroes.
Donald Trump and JD Vance didn't show strength today -- they showed weakness.
They belittled a giant and showed just how small they are.
They have the most vaunted titles in the world: President and Vice President of The United States of America. But the title doesn't make the man. And today both men brought shame to their titles.
A weary warrior was before them. A beleaguered man who has lost thousands of his friends and comrades to the unjust and illegal aggression of an authoritarian leader.
They showed no grace; no magnanimity of spirit; no diplomatic acumen. They were small bullies with big titles and they disrespected the history and legacy of the nation they lead.
Today, Donald Trump acted more like Russia's Putin than America's President.
Jeff Morgan ([email protected]) retweeted
Russia illegally and unjustifiably invaded Ukraine.
For three years now, Ukrainians have fought with courage and resilience. Their fight for democracy, freedom, and sovereignty is a fight that matters to us all.
Canada will continue to stand with Ukraine and Ukrainians in achieving a just and lasting peace.
Jeff Morgan ([email protected]) retweeted
You can’t take our country — and you can’t take our game.
Jeff Morgan ([email protected]) retweeted
Canada beats the United States in overtime officially adding America as the 11th province.
Congratulations to Premier Trump.






