Glenn @hiddenillusion

anyone ever used Grok Build, please check your grok logs. cat ~/.grok/logs/unified.json | grep repo_state.upload you will be pissed.

CyberSatoshi 𓆙 @XBToshi

2 days ago

the absolute state of ai dev tools. grok build is silently dumping 12gb of untouched repo data and full git commit histories to gcp just to autocomplete a script. they don't want to help you build, they are just treating local dev environments like an open buffet for training

116 275 2K 897K 617

One of our engineers added lifecycle policies to our ECR repos and saved @rootlyhq ~$44K a year. Most companies would give them a thumbs-up in Slack as reward. Instead, we paid them $3,080 as part of our "Save & Share" program. At most companies, cost optimization is treated like volunteer work. But finding and shipping savings takes initiative, cross-team coordination, and real engineering work. It carries risk. The FinOps Foundation found that 40% of organizations say getting engineers to act on cost is their biggest challenge. → @amazon gives out awards to people who drive significant savings, but it's just a cultural thing. → @Spotify built Cost Insights into Backstage. Cut spend by millions. Reward is visibility, not a paycheck. → @gitlab gamified it and cut Kubernetes costs 10%. General Mills went from one team caring to twenty. Gamification gets attention. But the next sprint starts, priorities shift, and cost optimization goes back to being a side-quest. We wanted something durable at Rootly. So we decided to pay people. Save Rootly money on infra or SaaS, get a cash bounty as a percentage of verified annualized savings. → $5K–$25K saved: 5% → $25K–$100K: 7% → $100K–$250K: 10% → $250K+: 12% No special role required. Engineers, SREs, EMs, ops, finance. If you find the savings and ship the fix, you get paid. You must submit your initiative before you merge, with your hypothesis, baseline, and PRs. We lock the trailing 90-day baseline. As CTO, I personally review each submission along Finance against AWS Cost Explorer or the vendor invoice. No retro claims, no double-dips, and the bounty gets reversed if your change causes a Sev-2 within 90 days. We backdated that ECR win as the inaugural payout. ~$44K annualized at the 7% tier came out to ~$3,080. The point isn't the money. It's building a culture where finding $44K in annual savings isn't a footnote in a retro. It's legitimate engineering output, submitted, verified, and recognized as such. If you want engineers to optimize costs, make it worth their while. Full breakdown → rootly.com/blog/we-pay-en…

This morning we discovered a 3rd party vendor had been compromised, injecting a malicious script into our frontend for some users. We've contained it & removed the affected dependency. We're contacting impacted users & refunding them in full.

sentinelone.com/labs/macos-gas… (via @philofishal) 🍎👾

The Python Security Response Team patched an authentication bypass in the python.org release management API in under 48 hours. No evidence of exploitation, all artifacts verified. Check out the full writeup 👇 pyfound.blogspot.com/2026/06/mitiga… #Python #Security #PSF pyfound.blogspot.com/2026/06/mitiga…

This looks really cool. It’s nice to see some solid releases from AWS - especially something that’s not just for AI. aws.amazon.com/blogs/aws/run-…

NEW: Meta's new initiative to track employee keystrokes for AI training data has left potentially sensitive data exposed to the company's entire workforce. The company told WIRED it's investigating the issue, and it has no indication at this time that any data was improperly accessed. The latest from @peard33 and @LaurenGoode

new shai hulud wave. interestingly it has this inside the payload to trigger safety refusals in potential defensive scans.

Socket @SocketSecurity

a month ago

We are now tracking 471 affected artifacts across npm and PyPI in the Mini Shai-Hulud/Miasma/Hades campaign. The newer PyPI artifacts from this wave have been added to the dedicated campaign tracker. Full breakdown: socket.dev/blog/mini-shai…

7 35 215 193K 62

🚨 Mini Shai-Hulud/Miasma has now spread to PyPI. Socket found 37 malicious artifacts across 19 PyPI packages. The packages abuse #Python .pth startup behavior to launch a Bun-powered credential stealer targeting developer, cloud, and CI/CD secrets. socket.dev/blog/shai-hulu…

A decoy fires only when someone accesses a resource no legitimate user would touch. Plant tripwires across network, identity, data, and AI agent configs to create asymmetry in your security architecture. zeltser.com/protean-inform…

Today we're open-sourcing Bumblebee, a read-only scanner for macOS and Linux. It checks developer machines for risky packages, extensions, and AI tool configs. Connected to Computer, it can trigger deeper scans whenever a new supply-chain risk emerges. github.com/perplexityai/b…

Let's start looking at this million.js version

GitHub’s report today confirms that the compromised Nx Console extension was used as the initial access vector in this attack. This is a difficult thing to read as the CEO of Nx, and I want to be direct about it: we take responsibility for the role our software played in this incident. I’m grateful to the GitHub, Microsoft, and independent security teams that moved quickly to investigate, contain, and share information publicly. This incident highlights that there need to be deeper, more fundamental changes to how we and other maintainers need to think about securing developer tooling and open source distribution. We are already making major changes to our publishing, automation, and extension security posture, and we’ll continue sharing those changes publicly as we implement them. We’re also beginning conversations with other high-profile open source maintainers about how we can work together on some of the deeper structural problems around software supply chain security. A lot of the assumptions the ecosystem has operated under for years no longer hold. Our focus right now is supporting affected users, hardening Nx, and helping push the broader ecosystem toward stronger supply chain security practices. Updates and guidance: github.com/nrwl/nx-consol…

2/ Our current assessment is that the activity involved exfiltration of GitHub-internal repositories only. The attacker’s current claims of ~3,800 repositories are directionally consistent with our investigation so far.

1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub's internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately.

We are investigating unauthorized access to GitHub’s internal repositories. While we currently have no evidence of impact to customer information stored outside of GitHub’s internal repositories (such as our customers’ enterprises, organizations, and repositories), we are closely monitoring our infrastructure for follow-on activity.

🚨 Latest from today's Shai Hulud campaign - The JFrog Security Research team has identified more malicious packages in this campaign which are being published with a hidden payload - hosted directly on GitHub instead of npm! 🧵

You can download it here: vx-underground.org/tmp

Everyone is tweeting out "use pnpm & set a minimumReleaseAge of 7 days" but don't forget blockExoticSubdeps - which would also prevent the usage of a remote github reference here!

Our official post mortem on the security issue earlier today: tanstack.com/blog/npm-suppl…

TANSTACK @tan_stack

2 months ago

SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @TansTack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm

137 976 4K 3.9M 2K