Bullder - Bitcoin | Lightning | Bitcoin class of 2140
Luis Alves
Joined July 2015
- Tweets13.6K
- Following5.2K
- Followers1.3K
- Likes16.5K
Zhou Tonged - Holding (Billy Joel - The Longest Time) youtu.be/NG1qooBzE2w?is=JJB7… via @YouTube
76
HASHRATE retweeted
Possibly the best Bitcoin explainer video for kids and adults 🧡
by @tether
Vale a pena ler essa cadeia de e-mails. Se ficar difícil para entender cópia e cola no chat gpt e pede para te explicar resumidamente.
Everyone should read the Bitcoin whitepaper. Once you're deep enough down the rabbit hole you should go read the original email thread in which it was announced. You'll recognize many criticisms that are rehashed to this day.
mail-archive.com/search?l=cr…
60
HASHRATE retweeted
On this day in 2008, Satoshi published the Bitcoin white paper.
Two months earlier, Satoshi emailed @adam3us to ask how to cite Hashcash. Bitcoin builds on its proof-of-work so no one has to be in charge.
Eighteen years on, Bitcoin is still the best place to build.
🤖 Made with AI
Bom trade você sente na barriga quase instinto. Trade fuleragem você sente no coração ou na cabeça.
1
90
Talvez seja por isso que a galera tá animada no Twitter. Quem comprou SIM barato precisa de gente comprando pra desovar sem destruir o book. Vão esperar virar 0 ou 1 ou buscam saída? Tô pouco me fudendo pro resultado, só não quero leigo entrando por causa de print e se ferrando.
2
562
HASHRATE retweeted
🤨 People keep asking how to protect yourself.
#1: set min-release-age=7 in .npmrc
#2: install Socket for GitHub (it's free!) to protect PRs from bad dependencies: socket.dev/features/github
#3: install Socket Firewall (also free!) to protect your laptop: socket.dev/features/firewall
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
Todo dia isso agora pqp
do you understand what just happened to one of the most used npm packages on the internet?
→ axios gets downloaded over 100 million times a week and today it got compromised
→ an attacker hijacked the npm credentials of a lead axios maintainer… changed the account email to an anonymous ProtonMail address… and manually published two poisoned versions
→ [email protected] and [email protected]… neither version contains a single line of malicious code inside axios itself. instead they inject a fake dependency called plain-crypto-js that drops a remote access trojan on your machine
→ the fake dependency was staged 18 hours in advance… three separate payloads were pre-built for macOS, Windows, and Linux… both release branches were hit within 39 minutes. every trace was designed to self-destruct after execution too
→ there’s no tag in the axios GitHub repo for 1.14.1. it was published outside the normal release process entirely... bypassed CI/CD completely
→ StepSecurity called it one of the most operationally sophisticated supply chain attacks ever against a top 10 npm package
→ a routine npm install silently opens a backdoor… no warning… no suspicious code visible in axios itself
this is the wake up call all vibe coding bros need to hear right now:
→ if you installed either version… assume your system is compromised
→ pin to [email protected] or [email protected]
→ rotate all secrets, API keys, SSH keys, and credentials on affected machines
→ check network logs for C2 connections
→ add –ignore-scripts to CI npm installs going forward
100 million weekly downloads and one compromised maintainer account…
that’s all it took to wreak absolute havoc
and I imagine we see a whole lot more of these… crazy times ahead for cybersecurity and vibe coding
be safe out there y’all
1
214
HASHRATE retweeted
Software horror: litellm PyPI supply chain attack.
Simple `pip install litellm` was enough to exfiltrate SSH keys, AWS/GCP/Azure creds, Kubernetes configs, git credentials, env vars (all your API keys), shell history, crypto wallets, SSL private keys, CI/CD secrets, database passwords.
LiteLLM itself has 97 million downloads per month which is already terrible, but much worse, the contagion spreads to any project that depends on litellm. For example, if you did `pip install dspy` (which depended on litellm>=1.64.0), you'd also be pwnd. Same for any other large project that depended on litellm.
Afaict the poisoned version was up for only less than ~1 hour. The attack had a bug which led to its discovery - Callum McMahon was using an MCP plugin inside Cursor that pulled in litellm as a transitive dependency. When litellm 1.82.8 installed, their machine ran out of RAM and crashed. So if the attacker didn't vibe code this attack it could have been undetected for many days or weeks.
Supply chain attacks like this are basically the scariest thing imaginable in modern software. Every time you install any depedency you could be pulling in a poisoned package anywhere deep inside its entire depedency tree. This is especially risky with large projects that might have lots and lots of dependencies. The credentials that do get stolen in each attack can then be used to take over more accounts and compromise more packages.
Classical software engineering would have you believe that dependencies are good (we're building pyramids from bricks), but imo this has to be re-evaluated, and it's why I've been so growingly averse to them, preferring to use LLMs to "yoink" functionality when it's simple enough and possible.
