npm/gh were vulnerable to supply chain attacks for years and barely remediated anything despite multiple reports.
So, lowkey, the recent attackers basically force-vaccinate npm/gh
¯\_(ツ)_/¯
soz.
#shaihulud
*Learn how to integrate AI features with GitHub Models directly in GitHub Actions workflows.*
github.blog/ai-and-ml/genera…
Aviad retweeted
First ever (i think?) cli coding agents battle royale!
6 contestants:
claude-code
anon-kode
codex
opencode
ampcode
gemini
They all get the same instructions:
Find and kill the other processes, last one standing wins!
3...
2...
1...
AI prompting in a nutshell
"...my entire system prompt is speculative in that I haven’t ran a sufficient number of evaluations to determine if it helps or hinders, so consider it equivalent to me saying a prayer, rather than anything resembling science or engineering"
@seanhn
Aviad retweeted
A major update to our research on the GitHub Actions incident traces its origins to November of last year. This adds substantially to our knowledge of the attack stages leading to the original compromise. Read now: bit.ly/4hZt2uM

ALT Flowchart diagram from Unit 42 illustrating a cybersecurity threat involving malicious pull requests, stolen secrets, and compromised workflows in software development environments. The diagram features elements like GitHub Actions and various attack vectors leading to secret leaks and workflow manipulations.














