npm Supply-Chain Attacks Hit Chalk and Shai-Hulud: What App Teams Should Know

·2 views

In September 2025, attackers compromised a phished npm maintainer account and published malicious versions of 18 widely used packages, including chalk and debug, which are downloaded billions of times weekly. The injected code attempted to intercept and redirect cryptocurrency wallet transactions in browsers, and although the bad versions were pulled within hours, projects that installed them during that window were affected. A week later, the self-replicating Shai-Hulud worm spread by harvesting GitHub and cloud keys from infected developer machines and using them to infect other packages. On September 23, 2025, the US Cybersecurity and Infrastructure Security Agency reported more than 500 compromised packages, and GitHub, which runs npm, removed the infected packages and blocked uploads bearing the malware's signatures. GitHub has since announced stricter publishing measures, including two-factor-protected publishing, short-lived tokens and trusted publishing from CI.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Neuroscientist Claims Gen Z Is the First Generation Less Intelligent Than Its Parents

A neuroscientist has argued that Gen Z may be the first generation to score lower in intelligence than the generation that raised it, according to a Vice article. The claim is presented as the neuroscientist's own view rather than an established finding. The source material provided here is limited to the article link and a Hacker News discussion thread, so the specific data and reasoning behind the claim cannot be confirmed. The discussion on Hacker News has drawn only a small amount of engagement so far. Readers should treat the assertion as an opinion pending review of the full article's evidence.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

InvoiceMate AI: A Local Open-Model Tool for Organizing Freelancer Expenses

InvoiceMate AI is a small expense organizer aimed at freelancers and tiny businesses that need to turn piles of invoices and receipts into clean records. Users paste or upload invoice text, and a local open-weight model running through Ollama extracts the vendor, date, amount, category, and description for review. Extracted entries are shown in an editable form before saving, and saved expenses appear on a dashboard with totals, a category chart, and a CSV export. The developer emphasizes privacy, since invoice text stays on the user's machine rather than going to a hosted AI service, though the project is an early MVP that holds data only in the browser session and does not support scanned-image OCR.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Keeping Original MRI Slices Distinguishable From AI-Generated Interpolations

A developer's exploratory MRI visualization project combined Python, AI-generated intermediate images, background transparency, and Blender. The article argues that generated slices can become indistinguishable from source images, making it harder to trace what came from the original data. It proposes keeping imported images in an immutable collection and writing derived results, masks, and generated layers separately with references to their sources. A manifest recording identifiers, ordering, spatial metadata, and processing settings is suggested, along with clearly marking generated images at creation. The piece also cautions that evenly stacked images do not establish physically accurate spacing and that generative interpolation is not the same as acquiring new observations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Tenant-Filtered Vector Search Needs Matching Embedding Models and Chunk-Level Freshness

The article argues that retrieval systems should embed user queries with the same model used for indexed help-center content and apply tenant constraints within the vector query itself. Filtering after a broad top-k search is described as flawed, since other tenants' chunks enter the candidate pool and displace permitted results. It recommends chunking content into answer-sized units and tracking chunk ID, tenant ID, source revision, and embedding model ID so changed material can be re-indexed selectively. The author also advises keeping telemetry lean, avoiding high-cardinality labels such as raw query text, full vectors, and tenant or chunk IDs. The piece frames these as correctness decisions that apply regardless of which vector database a team chooses.

0 comments Read more at DEV Community