Jonas
69.1K posts

Jonas
@jonelf
This too shall pass. Used to tweet about programming and infosec. Likes people, science, and music. Swedish & English. jonelf @ Keybase • jonelf.89 @ Signal









make: The Build Tool That Treats Tabs and Spaces as Mortal Enemies Stuart Feldman wrote make at Bell Labs in 1976 to automate the compilation of large C programs, inventing the concept of dependency-driven builds in the process. Its Makefile syntax uses tabs — not spaces, tabs — to denote recipe lines, and will fail silently and mysteriously if you use spaces instead. Feldman later admitted this was a bug he noticed early and couldn’t fix because too many Makefiles already existed. Forty-nine years on, make remains the default build tool on virtually every Unix system, and the tab requirement has broken the fingers, spirits, and deadlines of every developer who’s ever edited a Makefile in a space-happy text editor. Feldman has apologised. The tab requirement remains.


🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.



















