Joseph Werle

4.4K posts

Joseph Werle

Joseph Werle

@josephwerle

Staff Engineer @SocketSecurity | Maintainer @OroComputer, clib, bpkg | ex @RadNFTV, @Spotify, @AppNexus

NYC Katılım Eylül 2009
788 Takip Edilen648 Takipçiler
Joseph Werle retweetledi
Andrej Karpathy
Andrej Karpathy@karpathy·
New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads. Scanning my system I found a use imported from googleworkspace/cli from a few days ago when I was experimenting with gmail/gcal cli. The installed version (luckily) resolved to an unaffected 1.13.5, but the project dependency is not pinned, meaning that if I did this earlier today the code would have resolved to latest and I'd be pwned. It's possible to personally defend against these to some extent with local settings e.g. release-age constraints, or containers or etc, but I think ultimately the defaults of package management projects (pip, npm etc) have to change so that a single infection (usually luckily fairly temporary in nature due to security scanning) does not spread through users at random and at scale via unpinned dependencies. More comprehensive article: stepsecurity.io/blog/axios-com…
Feross@feross

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

English
555
1.1K
10.5K
1.5M
Joseph Werle
Joseph Werle@josephwerle·
daily messages from my agent Sven to my printer is a new kind of feeling
English
0
0
0
25
Joseph Werle retweetledi
FFmpeg
FFmpeg@FFmpeg·
@typememetics ffmpeg-rs comes with a free side order of delusion about speed improvements
English
16
30
1.5K
32.3K
Joseph Werle retweetledi
Feross
Feross@feross·
🚨 Open source supply chain attacks are exploding. Starting today, that ends. We’re releasing Socket Firewall — FREE, zero-config, CLI that blocks malware before it lands on your laptop or CI. Just run: npm i -g sfw sfw npm install lodash Works for: npm, yarn, pnpm, pip, uv, and cargo.
Feross tweet media
English
29
74
405
43.6K
Joseph Werle retweetledi
Socket
Socket@SocketSecurity·
Maintainer compromises used to be rare. Now they’re happening at an alarming rate, as seen in recent attacks. Today we’re giving developers a new layer of defense with Socket Firewall, a free tool that blocks malicious dependencies at install time.
Socket tweet media
English
3
13
41
9.7K
Joseph Werle retweetledi
Socket
Socket@SocketSecurity·
🚀 We’re kicking off another Launch Week at Socket, with a new feature launching every day! First up: Pull Request Stories, a dashboard view that helps security teams track supply chain risks by showing the real impact of every PR.
Socket tweet media
English
1
4
9
3.8K
Joseph Werle retweetledi
Feross
Feross@feross·
🚨 New critical vuln discovered in NestJS Devtools → Full RCE via the browser 😱 All you have to do is… visit a website. 🧵 Here’s how we went from “harmless dev tool” to “pop calc on your Mac”: @​nestjs/devtools-integration ships with a local HTTP server that accepts POST requests to /inspector/graph/interact That endpoint? It executes arbitrary JS using a “sandbox” 🤡 built on safe-eval — which is hilariously named. The sandbox uses vm.runInNewContext() — even though NodeJS explicitly says this is not a security mechanism. This means you can break out of it. And we did. Just needed a tiny payload to escape and run shell commands. But the real magic? You can trigger this from any website, thanks to a CSRF bypass trick using text/plain form posts. The result? Remote Code Execution just by visiting a webpage. No clicking required. We responsibly disclosed this to the NestJS team — they fixed it fast and with grace. Props to them 👏 🎯 CVE-2025-54782 📎 GHSA-85cg-cmq5-qjm7 🔍 Found via @SocketSecurity's AI-driven malware detection Full write-up (including POC): socket.dev/blog/nestjs-rc… This is why you don’t run “devtools” that parse and exec random JSON from localhost. Especially not using safe-eval.
Socket@SocketSecurity

🚨 Critical RCE in @nestjs/devtools-integration: A broken sandbox + CSRF lets any website trigger code execution on your dev machine if the dev server is running. Full disclosure: socket.dev/blog/nestjs-rc…

English
3
11
34
7.4K
Joseph Werle
Joseph Werle@josephwerle·
FAL is the infra you don't hear about, and that's good
@levelsio@levelsio

All my AI startups are powered by @FAL so I invested in them They're one of the nicest people to work with, extremely fast inference times but also extremely fast support The founders are Turkish and now I have a special thing for 🇹🇷 Turkey and wanna visit Istanbul, hard working people that don't tolerate bullshit, I like it The business case for FAL seems real, I tried setting up my own GPU server on @LambdaAPI, it's fun and I got quite far installing Claude Code and letting it do everything But you still get stuck pretty fast, it's a lot of work to manage the layer between GPU and actually getting an AI model to output something fast while being able to scale up on demand (remember other startups with their "Queued" problems when you try run a job) So FAL has its role, it backs a lot of the AI apps you use because the founders want to focus on building useful apps, not mess around with GPU servers

English
0
0
1
208
Joseph Werle retweetledi
MJ
MJ@mjackson·
I know you think you like React hooks. useState, useEffect, useMemo, useEffectEvent. You like the way they compose. The way they're "just functions". I will destroy them.
English
83
17
1.1K
171.8K
Joseph Werle retweetledi
Evan You
Evan You@youyuxi·
This just happened 👀
Evan You tweet media
English
162
256
3.5K
338.2K
Joseph Werle
Joseph Werle@josephwerle·
this is the best approach to TS. there is too much complexity expressed for no reason in too many projects where you spend more brain space thinking about types than the problem you set out to address
MJ@mjackson

The majority of my TypeScript code is just annotating method signatures, that's it. (Almost) everything else is inferred. Nowadays I find myself hovering over symbols in my editor, waiting for Intellisense to kick in and teach me about my code. So good.

English
0
0
1
117

Keşfet

@SocketSecurity @karpathy @grobmeier @feross @typememetics @elonmusk @BarackObama @taylorswift13