Marcus Wermuth retweeted
New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads.
Scanning my system I found a use imported from googleworkspace/cli from a few days ago when I was experimenting with gmail/gcal cli. The installed version (luckily) resolved to an unaffected 1.13.5, but the project dependency is not pinned, meaning that if I did this earlier today the code would have resolved to latest and I'd be pwned.
It's possible to personally defend against these to some extent with local settings e.g. release-age constraints, or containers or etc, but I think ultimately the defaults of package management projects (pip, npm etc) have to change so that a single infection (usually luckily fairly temporary in nature due to security scanning) does not spread through users at random and at scale via unpinned dependencies.
More comprehensive article:
stepsecurity.io/blog/axios-c…
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
Marcus Wermuth retweeted
You can now enable Claude to use your computer to complete tasks.
It opens your apps, navigates your browser, fills in spreadsheets—anything you'd do sitting at your desk.
Research preview in Claude Cowork and Claude Code, macOS only.
Marcus Wermuth retweeted
Today we've launched @parabol's random icebreakers generator on Product Hunt!
It was a labour of love between @BartoszJarocki, @nrqsnchz, @marcuswermuth and I.
If you'd like to support our launch, please consider checking it out:
producthunt.com/posts/random…
Some really great thoughts around engineering career ladders - go read the thread!
Marcus Wermuth retweeted
We hit 250,000 registered users! It may just be the way time has passed during the pandemic, but it feels like only yesterday that we were celebrating passing 10,000...
prbl.app/3O5VFHL
Marcus Wermuth retweeted
📢 Calling all product people!
We're writing a blog on Daily Standups tips, tricks, and earned secrets. And we need your help!
What are some of your tips for running a great Daily Standup?
Contribute your thoughts here and we may include you: forms.gle/zs5tXFXSfvxQdYNS6
I wrote down a few lessons that I learned @remote while being in hyper growth mode.
It's been a new and exciting challenge! 🚀 Here are a few tips for leading virtual teams in times of change.
remote.com/blog/leading-virt…
Feeling overwhelmed and stressed.
Not because of work, but because of too many things that are happening outside of it. Having a full time job, a young dog in training and a life makes it hard to get things done in my "free time".
Here's how I am going to tackle it.
🧵 👇
4/ All of this should feel more like a hiking trip less than multiple sprints connected to each other. I want to keep my breath and look out on the horizon, rather than gasping and just looking down on my feet to not fall.
I missed to post yesterday. That's ok though.
The past days I've been reflecting a lot on purpose and what it means. One thing I realized - it is ok to not know the answer immediately.
Atomic Essay No 15. for #ship30for30
A late but very important message ahead of the weekend.
❗️ We all have stressful and busy lives. Don't forget to be kind to yourself and take a break once in a while.
Atomic Essay No. 14 for #ship30for30
