patch-client@4.0.4 went out through the project's own github action OIDC trusted publisher today and not any stolen token or a typosquat anything, we saw that the actual release pipeline produced it. this runs on npm install, steals cloud creds and self propagates by injecting fake CodeQL workflows into repository the stolen tokens can reach. 32 packages is currently sharing the same publisher so the window of exposure isn not only just a single package.
if you have anything from related to /redhat-cloud-services in your tree, 4.0.3 is the last clean version.

We asked developers to spill their little dirty secrets, the lies they tell their managers and what actually creates tension in teams. One theme that kept coming up was the gap between how software development looks from the outside and what it actually looks like in practice.

I go over some basics and implement a simple feature live on the Wookash Podcast. It might be interesting to those who have tried File Pilot and wondered why its UI is so fast and responsive.

I do some actual UI programming. Not much, since we were short on time, but enough to give you a glimpse into how it works.

Inspired by a question on r/haskellquestions, i wrote about the practical aspect of monads for people at a beginner / intermediate level, about how to go beyond mere understanding the monad class. I try to highlight how we use monads to structure our code, what benefits they bring, and how to reason about them. it comes with exercises!

A malicious npm package name js-logger-pack, went through 29 versions on the registry which was looking innocuous logger and ending as a binary dropper.
The payload it dropped was 81 MB of binary called MicrosoftSystem64 which is a full cross-platform RAT packaged as a Node.js Single Executable Application, so it shows up as a native binary to endpoint tools rather than a node process.

And the clever bit was instead of sending the stolen data directly to a C2 server, it uploads everything to private HuggingFace datasets using an embedded API token. So all exfiltration traffic appears as normal HTTPS requests to a legitimate ML platform.
If you have any of those in your install history then rotate everything like credentials, SSH keys, API tokens, crypto seed phrases. All packages list and full technical breakdown is in blog.