Pinned
Today is my first day at @socket.dev ! 😱 Perfectly aligns with what I want. Stoked to get started 🧐
Peter van der Zee
@pvdz.ee
tafka @kuvos eng @socket.dev - 15yr js/ts - rust - ex vercel - ex fb - js1k-guy
454 followers92 following1K posts
Pinned
Today is my first day at @socket.dev ! 😱 Perfectly aligns with what I want. Stoked to get started 🧐
My team hard at work while I'm on a mini vacation. Mmm, wasnt litellm popped recently? Yunoroll?!?
🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.
Why don't openai/anthropic etc create an actual airgapped local network for their CTF training? Strikes me as not too hard to gate all egress. Anything not covered can be caught by a set of monkeys (->AIs), ask the requesting AI for what it was, and create a mock service to simulate it. Easy peasy?
Well. At least pypi gave it a run for its money. It got so stuck on account registration. Ultimately got through, of course. Some interesting lessons for pypi and fastly here (and other vendors). www.anthropic.com/research/ali... Transcript: raw.githubusercontent.com/anthropics/m...
About to get home after a week in the US for Socket. At home I let Claude fuzz preval all week long (5x plan). Outer bash loop starts Claude with prompt to fuzz and fix, repeat and keep going. Outer loop kills after 3h. After exit, sleep 1h and start again. Now let's see what kind of mess it made...
Must ... refrain... from logging in... during holiday... one more day. Good luck to anyone in/affected 🫂
🚨 Update: Watching this npm worm propagate in real time, we’re now tracking 2,234 affected package artifacts across 444 unique packages, and it’s still spreading. Average detection time: 5 min and 18 seconds after publication. Our campaign page includes all affected packages/versions.
"The data shows that many engineers spend in the range of hundreds of dollars a month to a few thousand dollars in tokens," um, wait. they call that tokenmaxxing at microsoft? wow, like they weren't even trying. lol slashdot.org/story/26/08/...