Keyv npm package compromised in active supply chain attack

·1 views

The Keyv npm package and several related libraries have been compromised in an active supply chain attack. The incident, dubbed 'Shai-Hulud,' was reported by security firm Aikido. Attackers targeted the npm ecosystem, injecting malicious code into widely used JavaScript packages. Developers relying on Keyv and its associated dependencies are potentially at risk. Users are advised to review the Aikido blog for technical details and remediation steps.

Read the full story at Hacker News

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

DeepSeek V4 Flash 0731 Corrupts JSON Integer Fields When Thinking Mode Is On

DeepSeek's retrained V4 Flash 0731 model has a documented defect where enabling its default thinking mode causes integer field corruption in strict JSON schema outputs, with 8 of 13 test runs returning wrong values despite schema-valid responses. The failure was observed across two independent request paths, with corrupted outputs including incorrect line-item counts and slightly wrong totals — errors silent enough to pass validation and reach production pipelines. Disabling thinking via the enable_thinking: false parameter resolved every corrupted run and reduced token usage to roughly one-seventh of the default. The corruption appears tied to the presence of thinking rather than its budget size, as even a capped 64-token budget produced the same errors. The preview build of V4 Flash remained clean across all four probed runs, while V4 Pro also showed corruption in 2 of 4 runs, suggesting the issue extends across the broader V4 thinking model family.

0 comments Read more at DEV Community

ProgrammingHacker News ·

Developer builds algorithm and color space tool for generating diverse skin tones

A developer has created a custom color space and procedural generation algorithm designed to simplify the selection of realistic and diverse skin tones for digital art and game development. The creator identified a gap in existing tools, finding it difficult to pick plausible skin tone variations for their own projects. The result is an interactive color picker with JavaScript-powered demos and detailed explanations of the underlying methodology. The tool is publicly available, and the developer has outlined several areas for future improvement.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Model Context Protocol: The Standard Helping AI Agents Connect to External Tools

The Model Context Protocol (MCP) is a communication standard that allows AI models to discover and interact with external tools, APIs, databases, and services in a uniform way. Before MCP, developers had to build separate custom integrations for every combination of AI model and external application, resulting in significant engineering overhead. MCP solves this by defining a shared protocol through which an AI client can find available tools, understand their functions, and execute them with structured inputs and outputs. The protocol involves two main components: an AI client that requests capabilities and an MCP server that exposes those capabilities in a consistent, machine-readable format. By establishing a common language between AI systems and external software, MCP reduces integration complexity and makes tools reusable across multiple AI platforms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SRE Incident Response Playbook: How to Handle Exposed Secrets Effectively

Site Reliability Engineer Tiexin Guo published a detailed guide on January 27, 2026, outlining how to build and use incident response playbooks, with a focus on secret leaks. The article emphasizes that effective playbooks must define goals, roles, communication channels, and documentation standards before any incident occurs. Guo highlights that secret leaks are harder to detect than typical outages because standard metrics like CPU usage and error rates may show only minor changes. Unlike service-down incidents that trigger immediate alerts, malicious actors exploiting leaked secrets can go unnoticed for extended periods. The guide also stresses the importance of testing playbooks through simulations and training team members to ensure readiness under pressure.

0 comments Read more at DEV Community