Sonika
1K posts


BREAKING: Vibe-coding platform Lovable reportedly suffered a breach that exposed users’ AI chat histories, source code, & database credentials.






🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.


Finally we are here with our product at @WTFxZo, go check it out at: startup-swarm-plum.vercel.app It's "Startup Swarm", your whole Startup team in one sandbox! Let the agents build your whole start up🗿🔥 One crazy thing happened in between, will drop that in next posts🤫 Till then show some support buying the subscription lol👀😂








