Dagens Vibes — 5. august 2026

Feross@feross

🚨 Active supply chain attack on npm: keyv and cacheable are compromised right now, and the payload is a worm. The maintainer account behind both package families was compromised. On August 4, ten packages were republished with a malicious preinstall hook that steals your credentials, then uses those credentials to publish itself into more packages. Malicious versions are live on npm as I write this. These are foundational packages. keyv, cacheable, flat-cache, and file-entry-cache sit deep in dependency trees as transitive deps of common tooling like ESLint. Tens of millions of weekly downloads. Most affected users never installed them directly. What the payload does: • preinstall hook (setup.mjs) downloads a standalone Bun runtime and runs the second stage under it, sidestepping the host Node version and any Node-level monitoring • Harvests cloud and CI credentials: AWS/GCP/Azure keys, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC, and npm tokens • Repackages other npm packages with the same hook and republishes them through npm OIDC trusted publishing. This is what makes it a worm. • Exfiltrates over DNS and by committing stolen secrets to attacker-created GitHub repos • Plants autostart hooks in .claude and .vscode that execute when a developer or an AI coding agent opens the cloned repo. No npm install required. The detail worth sitting with: keyv@6.0.0 shipped with a passing npm provenance attestation. The build pipeline faithfully attested a source that was already trojanized. Signature verification alone did not stop this. Socket’s AI scanner flagged the malicious setup.mjs hook. If you install anything in the keyv, @keyv, or cacheable scopes: • Pin to the last known-clean version and rebuild lockfiles by integrity hash. No caret or tilde ranges, no npm update. • Better: block the entire keyv, @keyv, and cacheable scope at your registry proxy until the account is confirmed clean. • Rotate and revoke every credential reachable from any host that ran install scripts. npm and GitHub tokens should be revoked, not just rotated. Developing story. Socket is updating the affected-package list as new versions appear. Full research report with IoCs: https://t.co/dyjGuLQ5Op If you are dealing with this right now and want help, email sales@socket.dev and we will spin up emergency white-glove assistance.

rita kozlov 🐀@ritakozlov

@Cloudflare incredible work from @nevikashah @mattsimpsn @FredKSchott and team read more → https://t.co/D2DvoztBVp

Dillon Mulroy@dillon_mulroy

RT @dok2001: We have been converting "how we build" @Cloudflare into RFCs with MUST and SHOULD statements that make it easy for agents to r…

Retweetet opslag

Dane Knecht 🦭@dok2001

We have been converting "how we build" @Cloudflare into RFCs with MUST and SHOULD statements that make it easy for agents to read. We are expanding agent enforcement beyond core review to design specs and incident reports. https://t.co/bFGQfKnOja

♥ 71↻ 8💬 1🔖 31

https://x.com/dok2001/status/2084665733837893790

Pi@pidotdev

Over the past few months Pi has consistently shown up in benchmarks as the best harness for both cost and performance. Earendil engineer @cristinaponcela examines case studies from @databricks and @Shopify highlighting why Pi’s minimalism is the advantage. Blog post below https://t.co/JfeKZ2n8Kn

Dillon Mulroy@dillon_mulroy

https://t.co/FVALfnALm8

Citeret opslag

Tibo@thsottiaux

Given some of the results I'm seeing recently, it's pretty clear Codex is a good harness. But it will seem primitive in 2-3 months and we're about to go through another major evolution in how we use AI at the frontier. The next generation of models need more than your laptop.

♥ 14718↻ 577💬 1700🔖 1683

https://x.com/thsottiaux/status/2084483765158719542

The Pragmatic Engineer@Pragmatic_Eng

You should start a brand new session as soon as the LLM tells you “you’re absolutely right” or “you were right to push back on that.” @DexHorthy, founder of HumanLayer and coiner of "context engineering": “Once the model starts doing dumb things, there’s four things in your context window that matter: the size, the quality of the information, whether there’s missing information, and then there’s the trajectory (the actual history of what the agent has done). If I say: “make this change”, and the model makes the change and runs the test and fixes it, I have high confidence the next change follows that path. But the example we talked about in “no vibes allowed”: the model makes a mistake, you yell at it, it makes another mistake, you yell at it. And then it’s like, what’s the next message in this conversation? If I read the history, I should probably make another mistake so the human can yell at me. So that’s a great example of time to start over."

Matteo Collina@matteocollina

I spent $0.034 with @deepseek_ai flash v4 0731 to fix a bug in @nodejs undici. This is part of my experiment to validate the unsubsidized cost of tokens. This is pretty solid. https://t.co/uGYIfjOroF https://t.co/CnMKuVBg1P