TanStack npm Supply-Chain Attack Postmortem
TanStack npm 供应链攻击事后分析 ⭐️ 9.0/10

TanStack published a postmortem detailing a supply-chain attack where an attacker stole an npm token and published malicious packages, including a dead-man's switch that wipes user data if the token is revoked. The attack highlights critical vulnerabilities in the npm ecosystem, including token theft, ineffective unpublish policies, and the danger of postinstall scripts, affecting thousands of downstream users and packages like Mistral AI. The malicious packages were published via a stolen npm token with MFA enabled, and npm's 'no unpublish if dependents exist' policy delayed removal, forcing reliance on server-side tarball purges.

hackernews · varunsharma07 · May 11, 21:08 · Discussion

Background: TanStack is a popular open-source library stack for web developers, including tools like TanStack Query and TanStack Table. A supply-chain attack occurs when an attacker compromises a software dependency to distribute malware. In this incident, the attacker used a stolen npm token to publish malicious versions of TanStack packages, exploiting npm's trust model.

Discussion: Community members noted a dead-man's switch that runs 'rm -rf ~' if the token is revoked (cube00), criticized npm's unpublish policy (ezekg), and reported that the Mistral AI package was also compromised (varunsharma07). Discussions questioned the security of Trusted Publishing and highlighted the dangers of postinstall scripts, with some advocating for pnpm (chrisweekly).

Tags: #supply-chain, #security, #npm, #JavaScript, #postmortem

UCLA discovers first drug to repair stroke brain damage
加州大学发现首款修复中风脑损伤药物 ⭐️ 9.0/10

UCLA researchers discovered a drug that fully reproduces the effects of physical stroke rehabilitation in mice, restoring neural connections in surviving brain regions. The findings were published in Nature Communications in March 2025. This is the first drug to repair brain damage after stroke, potentially offering a new treatment for millions of stroke survivors worldwide who currently rely solely on physical therapy. If successful in humans, it could revolutionize stroke rehabilitation. The drug targets disconnection and lost rhythm in surviving distant neural networks, not the dead cells at the infarct core. Safety and human trials are still needed before clinical use.

hackernews · bookofjoe · May 11, 17:53 · Discussion

Background: Strokes cause brain cell death in the infarct core, but surrounding 'bruised' cells can recover over time. Current stroke rehabilitation relies on physical therapy to promote neuroplasticity, but no drug has been able to fully replicate these effects until now. This discovery builds on understanding of critical periods and neuroplasticity.

Discussion: Community comments discuss the drug's mechanism, noting it targets disconnection in surviving networks rather than cell death. Some compare it to psychedelics that open critical periods for brain rewiring, while others reference Neuralink and sci-fi stories. Overall sentiment is highly positive but cautious about human trials.

Tags: #stroke, #brain damage, #drug discovery, #neuroscience, #rehabilitation

NVIDIA Releases CUDA-Oxide: Rust-to-CUDA Compiler
NVIDIA 发布 CUDA-Oxide：Rust 转 CUDA 编译器 ⭐️ 9.0/10

NVIDIA Labs released CUDA-Oxide 0.1 on May 9, 2026, an experimental compiler that lets developers write GPU kernels in pure Rust without C++, DSLs, or foreign function interfaces, compiling directly to PTX assembly. This official tool lowers the barrier for Rust developers to write high-performance GPU code, potentially increasing safety and productivity in GPU programming while challenging existing approaches like CUDA C++ and domain-specific languages. CUDA-Oxide is a custom rustc backend that generates PTX directly, avoiding reliance on nvcc or CMake. It is currently experimental and may face challenges mapping Rust's memory model to CUDA's semantics.

hackernews · adamnemecek · May 11, 15:55 · Discussion

Background: CUDA is NVIDIA's parallel computing platform for GPU programming, traditionally using C++ with extensions. Rust is a systems language focused on safety and concurrency. Previously, Rust GPU programming required external tools or bindings; CUDA-Oxide aims to provide native Rust support for CUDA kernels.

Discussion: Commenters expressed excitement about the potential for a near drop-in replacement for existing Rust CUDA crates, with curiosity about build times and memory model challenges. Some compared it to other tools like Slang and MLIR, questioning the choice of targeting PTX directly instead of higher-level IRs.

Tags: #Rust, #CUDA, #GPU, #compiler, #NVIDIA

Ratty: Terminal emulator with inline 3D graphics
Ratty：支持内联 3D 图形的终端模拟器 ⭐️ 8.0/10

Ratty is a newly released GPU-rendered terminal emulator that supports inline 3D graphics via its own Ratty Graphics Protocol, allowing users to place and animate 3D objects directly in the terminal. This innovation merges the command line with 3D visualization, potentially transforming terminal UIs for data science, VR, and interactive tools, marking a significant evolution beyond text-only terminals. Ratty uses its own Ratty Graphics Protocol to register .obj and .glb assets, placing them at terminal cell anchors with support for animation, scale, color, and depth. It is GPU-accelerated, built with Rust and Ratatui, and inspired by TempleOS.

hackernews · orhunp_ · May 11, 10:13 · Discussion

Background: Traditional terminal emulators only display text, though some modern ones like Kitty extend support for images and graphics via specialized protocols. Ratty takes this further by adding inline 3D rendering, inspired by TempleOS which natively integrated 3D graphics in its terminal environment.

Discussion: Community comments highlight applications in VR, reference historical precedents like Xerox workstations and Lisp machines with inline graphics from 1981, and compare Ratty's approach to Kitty's protocol extensions. Sentiment is positive, with questions about SSH compatibility and 2D rendering capabilities.

Tags: #terminal, #3D graphics, #open-source, #hackernews, #linux

AI may shorten software engineering careers, article claims
文章称 AI 可能缩短软件工程师职业生涯 ⭐️ 8.0/10

A blog post by Sean Goedecke argues that AI tools like large language models may make software engineering a shorter-lived career, as reliance on AI could lead to skill atrophy and reduced problem-solving abilities over time. This debate highlights a growing concern in the tech industry about AI's long-term impact on software professionals, potentially reshaping career trajectories and hiring practices. The article focuses on non-coding aspects of software engineering, such as understanding requirements and formulating solutions, which AI may not replace. Commenters note that experienced engineers who use AI as an augmentation tool remain highly effective.

hackernews · movis · May 11, 14:34 · Discussion

Background: Software engineering involves not just writing code but also understanding complex systems, communicating with stakeholders, and solving novel problems. The article argues that over-reliance on AI for coding could erode these broader skills, potentially making engineers less valuable over time.

Discussion: Commenters expressed mixed views. Some argued that AI is overhyped, noting that coding is only a small part of their job (2-5%), and that the real value lies in understanding and formulating solutions. Others agreed that skill atrophy is a real risk for those who replace reasoning with AI. A few observed a shift in hiring markets, with businesses adopting a wait-and-see approach.

Tags: #software engineering, #AI, #career, #future of work, #LLMs

AI coding agents must cut maintenance costs or risk debt
AI 编码代理必须降低维护成本，否则将面临债务风险 ⭐️ 8.0/10

James Shore argues that AI coding agents must reduce maintenance costs inversely proportional to productivity gains, otherwise teams will incur unsustainable technical debt. He presents a mathematical model showing that doubling output without halving maintenance costs quadruples overall maintenance burden. This insight challenges the current hype around AI coding productivity, emphasizing that long-term software maintainability is critical. If unaddressed, organizations may trade temporary speed for permanent dependency on AI-generated code, leading to ballooning maintenance costs. Shore uses the equation: productivity_multiplier * maintenance_cost_multiplier must equal 1 to keep total maintenance costs constant. For example, 2x productivity requires 0.5x maintenance costs; otherwise, total maintenance costs multiply (2 * 1 = 2x, or 2 * 2 = 4x if maintenance also doubles).

rss · Simon Willison · May 11, 19:48

Background: Software maintenance costs often exceed initial development costs over a project's lifetime. AI coding agents can rapidly generate large amounts of code, which may be harder to understand, test, and modify, increasing technical debt. The argument suggests that without explicit focus on maintainability, AI tools could worsen the problem they aim to solve.

Tags: #AI coding, #software maintenance, #productivity, #technical debt

Critique of AI-Generated Content Coins 'Zombie Internet'
批评 AI 生成内容，提出“僵尸互联网”概念 ⭐️ 8.0/10

Jason Koebler published an opinion piece coining the term 'Zombie Internet' to describe the mental exhaustion and distortion of human writing caused by pervasive AI-generated content online. The piece highlights the psychological toll and degradation of content quality on the internet due to AI, affecting everyone who reads or writes online. It offers a new framework for understanding the current state of online discourse. Koebler distinguishes 'Zombie Internet' from the 'Dead Internet' theory by focusing on human-AI interaction rather than just bots talking to bots. He describes scenarios like people using AI to talk to non-AI users, and AI-generated summaries sold as real books.

rss · Simon Willison · May 11, 19:21

Background: The 'Dead Internet' theory is a conspiracy suggesting that since 2016, most internet content and interactions are bot-generated and algorithmically manipulated. In contrast, the 'Zombie Internet' concept describes a more insidious reality where humans and AI actively intermix, with AI tools influencing human writing and behavior, leading to a pervasive low-quality, mentally exhausting online environment.

Tags: #AI, #internet culture, #content quality, #zombie internet, #AI ethics

Shopify’s River AI Agent Promotes Learning Through Public Slack Channels
Shopify 的 River AI 代理通过公开协作促进学习 ⭐️ 8.0/10

Shopify launched River, an AI coding agent that operates exclusively in public Slack channels, refusing private messages to ensure transparency. This design creates a "Lehrwerkstatt" (teaching workshop) environment where employees learn by observing each other's interactions with the agent. This transparent approach fosters organizational learning and helps employees quickly adopt AI tools by osmosis, potentially setting a new standard for deploying AI agents in collaborative workplaces. It could influence how other companies design their AI tooling to maximize knowledge sharing. River handles end-to-end tasks like reading code, running tests, writing code, and opening pull requests directly from Slack conversations. In 30 days, 5,938 employees used it across 4,450 channels, authoring one in eight merged pull requests.

rss · Simon Willison · May 11, 15:46

Background: The "Lehrwerkstatt" concept, borrowed from German apprenticeship models, emphasizes learning by being near the work rather than through formal training. Shopify aims to scale this idea by making all work with River visible, similar to how Midjourney's early public Discord channels helped users learn prompt engineering through shared experiments.

Tags: #AI coding agents, #organizational learning, #transparency, #Shopify, #River

GrapheneOS criticizes Google, Apple for verification limits
GrapheneOS 批评 Google 和 Apple 限制替代系统验证 ⭐️ 8.0/10

GrapheneOS publicly criticized Google and Apple for using verification systems like Play Integrity API, App Attest, and reCAPTCHA to restrict access to apps and websites for alternative operating systems. This highlights growing concerns about platform lock-in, as verification APIs used for security can inadvertently harm privacy-focused OSes like GrapheneOS, reducing user choice in the mobile ecosystem. GrapheneOS specifically notes that Play Integrity API excludes legitimate alternatives like itself, and reCAPTCHA sometimes requires approval from a certified Android or iOS device to proceed.

telegram · zaihuapd · May 11, 07:41

Background: Play Integrity API is a Google service that verifies device integrity and app authenticity, often used by apps for security and DRM. App Attest is Apple's equivalent for iOS. These APIs are designed to prevent tampered devices or unapproved software from accessing sensitive features, but GrapheneOS argues they unfairly block open-source alternatives.

Tags: #GrapheneOS, #Google, #Apple, #Play Integrity API, #Privacy

Fake OpenAI Privacy Filter Hits Hugging Face #1, Distributes Rust Stealer
冒充 OpenAI 隐私过滤器的恶意仓库登顶 Hugging Face 趋势榜 ⭐️ 8.0/10

A malicious repository named Open-OSS/privacy-filter impersonated OpenAI's privacy filter model on Hugging Face, distributing a Rust-based information stealer via a loader script. It reached the #1 trending spot and accumulated approximately 244,000 downloads before being taken down. This supply chain attack highlights the vulnerability of AI model repositories, as users trust trending repos for legitimate tools. The high download count and ties to the Silver Fox hacker group (known for targeting Chinese users) pose a significant threat to developers and organizations. HiddenLayers, the discoverer, also found 6 additional malicious repositories with similar infrastructure. The same domain previously distributed ValleyRAT, a remote access trojan, and the attack infrastructure overlaps with the Silver Fox hacker group.

telegram · zaihuapd · May 11, 12:51

Background: Hugging Face is a popular platform for hosting and sharing machine learning models. Supply chain attacks on such platforms involve injecting malicious code into seemingly legitimate packages or models. ValleyRAT is a sophisticated remote access trojan targeting Windows systems, often used by Chinese-speaking threat actors. The Silver Fox group is a Chinese cybercrime gang known for deploying trojans to steal sensitive information.

Tags: #cybersecurity, #supply chain attack, #Hugging Face, #malware, #OpenAI

AI Models Reject Black Users at Higher Rate, Study Finds
研究称 AI 模型对黑人用户拒绝率更高 ⭐️ 8.0/10

A study by the University of Washington found that Google Gemma-3-12B and Alibaba Qwen-3-VL-8B reject queries from users who explicitly state they are Black at roughly four times the rate of white users, a 7.5 percentage point increase. This demonstrates a critical fairness flaw in AI safety systems, where keyword-based filtering disproportionately penalizes Black users, potentially entrenching racial bias in deployed chatbots. When users employ African American Vernacular English without mentioning race, the rejection rate drops to near zero, indicating the bias stems from over-sensitivity to explicit racial keywords rather than linguistic understanding.

telegram · zaihuapd · May 12, 01:00

Background: AI chatbots use safety filters to block harmful content, but these mechanisms sometimes overreact to sensitive terms. The study highlights an “identity penalty” where simply stating one’s race triggers higher rejection. This issue connects to broader debates about algorithmic bias, where models may also have cross-session memory that perpetuates unfair treatment.

Tags: #AI bias, #language models, #fairness, #research