Sanka Darshana
9.6K posts

Sanka Darshana
@SankaD
Working on Web 3.0 / AND Music 🎶. Pushing forward the dream of Web 3.0 ⛓️💥 #DrumsOfLiberation $SAITO



Codex can now use the in-app browser to test your app at different viewport sizes! It will control the device tool bar and click through your app at different breakpoints to validate & iterate. If it's a long run, Codex will take screenshots at key moments during testing and show them to you at the end of the turn, so you can verify its work. To speed up testing, Codex can hide the IAB to disable animations, and accelerate testing by 1-2x. Separately, we also made annotations send faster and consume less tokens. Hope you enjoy the updates and let us know what you think!

‼️🚨 UPDATE: The TanStack npm attack is now a full campaign. 'Mini' Shai-Hulud has hit: - OpenSearch - Mistral AI - Guardrails AI -UiPath - Squawk packages across npm and PyPI The malware specifically targets AI developer tooling. It hooks into Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to re-execute on every tool event, long after the infected package is gone. npm uninstall does not fix this.

$10 million or the chance to wait this table?

🚨 How the TanStack npm attack actually happened: 1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo. 2. GitHub automatically ran CI tests on that PR. 3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run. 4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays. 5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.

🚨 UPDATE: Mini Shai-Hulud has crossed from @npmjs into @pypi and is still spreading. Newly confirmed compromised artifacts: @opensearch-project/opensearch: 3.5.3, 3.6.2, 3.7.0, 3.8.0 (1.3M weekly downloads) mistralai: 2.4.6 on PyPI guardrails-ai: 0.10.1 on PyPI additional @squawk/* packages on npm guardrails-ai 0.10.1 executes malicious code on import. On Linux, it downloads git-tanstack[.]com/transformers.pyz, writes it to /tmp/transformers.pyz, and runs it with python3 without integrity verification. The git-tanstack.com domain displayed a message signed “With Love TeamPCP,” along with: “We've been online over 2 hours now stealing creds Regardless I just came to say hello :^)” The page also linked to a YouTube video and you can probably guess which one.

tbh I believed in aliens until the politicians said they were real. Now I know we are alone in the universe.

The Germans have some strange festivals:

One Piece in a nutshell 😭









