xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦
26.6K posts

xpinjection 🇺🇦
@xpinjection
Tech & AI Consultant | Solution Architect & CTO | Digital Transformation Lead | Org & Agile Coach | Founder & Trainer at XP Injection | Speaker
Ukraine, Kiev Beigetreten Eylül 2010
58 Folgt3.7K Follower
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet

Software horror: litellm PyPI supply chain attack.
Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.
LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.
Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.
Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.
Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.
Daniel Hnyk@hnykda
LiteLLM HAS BEEN COMPROMISED, DO NOT UPDATE. We just discovered that LiteLLM pypi release 1.82.8. It has been compromised, it contains litellm_init.pth with base64 encoded instructions to send all the credentials it can find to remote server + self-replicate. link below
English
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet

We doubled Claude usage on weekends, and outside 5–11am PT on weekdays for the next 2 weeks.
Claude@claudeai
A small thank you to everyone using Claude: We’re doubling usage outside our peak hours for the next two weeks.
English
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet

Released today: /loop
/loop is a powerful new way to schedule recurring tasks, for up to 3 days at a time
eg. “/loop babysit all my PRs. Auto-fix build issues and when comments come in, use a worktree agent to fix them”
eg. “/loop every morning use the Slack MCP to give me a summary of top posts I was tagged in”
Let us know what you think!
English
xpinjection 🇺🇦 retweetet

Prof. Donald Knuth opened his new paper with "Shock! Shock!"
Claude Opus 4.6 had just solved an open problem he'd been working on for weeks — a graph decomposition conjecture from The Art of Computer Programming.
He named the paper "Claude's Cycles."
31 explorations. ~1 hour. Knuth read the output, wrote the formal proof, and closed with: "It seems I'll have to revise my opinions about generative AI one of these days."
The man who wrote the bible of computer science just said that. In a paper named after an AI.
Paper: cs.stanford.edu/~knuth/papers/…

English

xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet

> Anthropic just launched a free AI academy with 13 certified courses across MCP, APIs, Claude Code and more.
> it’s completely free
Peter Agboola@baba_Omoloro
Anthropic has launched free courses to master AI with certificates for $0.00 anthropic.skilljar.com
English
xpinjection 🇺🇦 retweetet

Росія програла «битву за зиму». А ми виграли. Перший день весни. Сонячний день довшає. Стає тепліше. Україна продовжує боротьбу.
На фронті, вперше за багато місяців, а може й років, ми почали звільняти більше територій аніж втрачати.
Дякуємо тим, хто тримає фронт.
Дякуємо силам протиповітряної оборони.
Енергетикам.
Комунальникам.
Місцевій та центральній владі.
І кожному з нас, за стійкість.
Україна виграла битву за зиму.
Українська
xpinjection 🇺🇦 retweetet
xpinjection 🇺🇦 retweetet

🚨 BREAKING: A developer on GitHub just built a tool that turns any GitHub repo into an interactive knowledge graph and open sourced it for free.
It's called GitNexus. Think of it as a visual X-ray of your codebase but with an AI agent you can actually talk to.
No server. No subscription. No enterprise sales call.
Here's what it does inside your browser:
→ Parses your entire GitHub repo or ZIP file in seconds
→ Builds a live interactive knowledge graph with D3.js
→ Maps every function, class, import, and call relationship
→ Runs a 4-pass AST pipeline: structure → parsing → imports → call graph
→ Stores everything in an embedded KuzuDB graph database
→ Lets you query your codebase in plain English with an AI agent
Here's the wildest part:
It uses Web Workers to parallelize parsing across threads so a massive monorepo doesn't freeze your tab.
The Graph RAG agent traverses real graph relationships using Cypher queries not embeddings, not vector search. Actual graph logic.
Ask it things like "What functions call this module?" or "Find all classes that inherit from X" and it traces the answer through the graph.
This is the kind of code intelligence tool enterprise teams pay thousands per month for.
It runs entirely in your browser.
Works with TypeScript, JavaScript, and Python.
100% Open Source. MIT License.
Repo: github.com/abhigyanpatwar…
English










