Brume

@npmjs @GHSecurityLab there is an active supply chain attack on axios@1.14.1 which pulls in a malicious package published today - plain-crypto-js@4.2.1 - someone took over a maintainer account for Axios

What happened with the @Ethereum Foundation? > They contact me because they want to use my code in their SDK, > I say ok but please grant us or at least talk about us, > They add me to multiple groups with endless technical discussions about my code, > They say we can't grant you but we can make you work for us and you get paid, > I say fuck off I want a grant not a job, as I already worked hard since 2022, and you want to use my code, > I get angry about them because I wasted valuable time with endless discussions for nothing, > They send me to another team to apply for a grant but it requires KYC and it's not even sure if I will get a grant, 6 months after the initial contact, not a single penny, not a single retweet, not a single like, no a single mention on their wallet list or anywhere, and I need to start over with another team, do endless discussions again, do extensive paperwork, do extensive KYC, to maybe have a grant if they are willing to (they won't and I will loose time again) > I see Vitalik posting tweets about privacy, private wallets, and their private SDK, still without mentioning Brume > I get disappointed, reveal their tactics to everyone, and ban them from using my code What would you do in this situation?