Co-founder of App and Up Srl 👨💼 - I work and have fun on web, mobile and anything that involves code
Roma, Lazio
Joined July 2017
- Tweets3.2K
- Following340
- Followers1.2K
- Likes5.1K
Daniele Cambi retweeted
🚨 How the TanStack npm attack actually happened:
1. Attacker opened a normal-looking pull request (#7378) on the TanStack repo.
2. GitHub automatically ran CI tests on that PR.
3. Code inside the PR stole the workflow's GitHub Actions Cache write token during the test run.
4. The attacker used that token to plant poisoned files in the shared build cache. The PR could be closed afterwards. The poisoned cache stays.
5. The official release workflow later pulled from the cache, baked the malicious files into the build, and signed and published 84 malicious package versions to npm.
This attack leveraged GitHub Actions Cache Poisoning.
Payload deployed here: github.com/TanStack/router/p…
It looks like it detonated here: github.com/TanStack/router/a…
Daniele Cambi retweeted
Drizzle v1.0.0-rc.1 is out 🚀
▪︎ Effect v4 native support
▪︎ JIT row mappers to reduce ORM overhead to ~0
▪︎ Reworked casing API (breaking change)
▪︎ Drizzle for LLM agents (preview)
Drizzle is now as fast as using raw driver and mapping(or not mapping) results by hand 🙃
Daniele Cambi retweeted
We’ve identified a security incident that involved unauthorized access to certain internal Vercel systems, impacting a limited subset of customers. Please see our security bulletin:
vercel.com/kb/bulletin/verce…
Daniele Cambi retweeted
🛡️ React Native Security Rule #6 :
AsyncStorage is NOT secure storage.
If you save tokens, passwords, or credentials there, you’re storing them in plaintext. On rooted/jailbroken devices, attackers can dump it in seconds.
AsyncStorage is fully readable.
Treat it as public, not private.
Never store:
• auth tokens
• passwords
• API secrets
Use instead:
• expo-secure-store
• react-native-keychain
• native Keychain / Keystore
Daniele Cambi retweeted
Vibe coding is a consequence of inexperienced engineers attempting to overcome their imposter syndrome complexes. AI is a tool that you simply have to use to get the job done.
We'll be fine once s*** hits the fan and we have to start doing things the right way again.
Daniele Cambi retweeted
IT HAPPENING!!!!!!!!
Materal and Cupertino are getting their own packages!!!
github.com/flutter/flutter/i…
Daniele Cambi retweeted
in my vibe coding experiments, as soon as the app gets reasonably complex, llms essentially never work properly on it again. leaving you to debug some reasonably complex codebase full of weird abandoned code that you have no mental context checkpoints for.
Daniele Cambi retweeted
PascalCaseForTypes
SCREAMING_SNAKE_CASE_FOR_CONSTANTS
dash-case-for-file-names.ts
snake_case_for_databases
camelCaseForEverythingElse
Daniele Cambi retweeted
been saying this since 2022. if llms are killing it for you it just means you’re working on easy problems in a small codebase
Top LLM models these days can already work as a junior developers
…as long as the whole code base is less than ~200k tokens (There are some workarounds, bit not quite good enough).
My main code base is currently ~4.5M tokens long.
It would be a real oh-shit moment when we get to the point it can comprehend the whole thing plus being smarter.
Even without agency/autonomy it's already a big change!
Maybe I dont need to hire a new dev anymore.
Daniele Cambi retweeted
I like how so many Flutter devs on here are just utterly convinced that React Native is absolute garbage when it's pretty obvious that there are plenty of teams of all skill levels shipping great apps with it.
also swap "Flutter" and "React Native" and reread it
Daniele Cambi retweeted
What started as a leap of faith turned into a historic journey !!! It’s been real, I love you all ✌🏾
