• One worm took twelve unrelated organisations between 09:35 and 13:18 UTC on 4 August 2026, each republishing its whole namespace within seconds.

• The confirmed footprint is 2,234 poisoned versions across 444 package names. latest still resolves to a poisoned version on most affected names, so upgrading is not a fix. The maintainers have since cleaned the keyv and cacheable family and unpublished its poisoned releases, which does not help a lockfile pinned while they were live.

• Every poisoned release adds "preinstall": "node setup.mjs", which runs on a bare npm install. Disable install scripts in CI, and treat any npm token used in CI during the window as compromised.

• The payload steals GitHub, npm, AWS, GCP, Azure, Stripe, Vault and Kubernetes credentials, scrapes GitHub Actions runner memory, and can republish packages with valid SLSA provenance.

• It installs a dead-man’s switch that polls GitHub with the stolen token and executes a handler when that token is revoked. Hunt it before rotating anything, because rotation is the trigger.

• Poisoned packages include the auth libraries @or-sdk/auth, @or-sdk/api-tokens, @or-sdk/permissions and @arv-bedrock/auth. The @ornikar packages are mostly lint and build configs, which land on CI runners and developer laptops as dev dependencies.

• There is no C2 host. Exfiltration rides GitHub dead-drop repositories and Actions artifacts under RSA-4096 encryption, and stage one pulls its runtime from the official Bun releases, so no attacker domain appears at either stage.

• 546 dead-drop repositories described Shai-Hulud: Here We Go Again appeared on 4 August 2026, and the same marker appears on the TanStack compromise dated 11 May 2026.

• The keyv repository also ships .claude/settings.json and .vscode/tasks.json hooks that execute when the project opens in an IDE or agent session. Both are still on main.

• The commit that added those hooks shows as verified by GitHub with its author spoofed to github-actions[bot], and the poisoned keyv release carries intact OIDC and SLSA attestation. Trust neither signal here.

Hosts TSConfigs for you to extend in your apps, tuned to a particular runtime environment. Owned and improved by the community. Basically Definitely Typed for TSConfigs.

Mailpit - email & SMTP testing tool with API for developers

Mailpit is a small, fast, low memory, zero-dependency, multi-platform email testing tool & API for developers.

It acts as an SMTP server, provides a modern web interface to view & test captured emails, and contains an API for automated integration testing (read more).

FlyDrive is a file storage library for Node.js. It provides a unified API to interact with the local file system and cloud storage solutions like S3, R2, and GCS.

Drive can be an excellent fit for applications that use cloud storage services to manage user-uploaded files. With Drive:

• You get a unified API for various storage services, including S3, R2, Digital Ocean spaces, GCS, and your local file system.
• Extensible API to add custom storage drivers.
• Unified exception handling.
• Baked-in security primitives to prevent common attacks like Path travesal.

A simulated bash environment with virtual filesystem

MLX is an array framework for machine learning on Apple silicon, brought to you by Apple machine learning research.

Some key features of MLX include:

• Familiar APIs: MLX has a Python API that closely follows NumPy. MLX also has fully featured C++, C, and Swift APIs, which closely mirror the Python API. MLX has higher-level packages like mlx.nn and mlx.optimizers with APIs that closely follow PyTorch to simplify building more complex models.

• Composable function transformations: MLX supports composable function transformations for automatic differentiation, automatic vectorization, and computation graph optimization.

• Lazy computation: Computations in MLX are lazy. Arrays are only materialized when needed.

• Dynamic graph construction: Computation graphs in MLX are constructed dynamically. Changing the shapes of function arguments does not trigger slow compilations, and debugging is simple and intuitive.

• Multi-device: Operations can run on any of the supported devices (currently the CPU and the GPU).

• Unified memory: A notable difference from MLX and other frameworks is the unified memory model. Arrays in MLX live in shared memory. Operations on MLX arrays can be performed on any of the supported device types without transferring data.

MLX is designed by machine learning researchers for machine learning researchers. The framework is intended to be user-friendly, but still efficient to train and deploy models. The design of the framework itself is also conceptually simple. We intend to make it easy for researchers to extend and improve MLX with the goal of quickly exploring new ideas.

The design of MLX is inspired by frameworks like NumPy, PyTorch, Jax, and ArrayFire.

Very interesting that these guys use the open-source parse server but host it for you.

The business needs engineers that can adapt to the dynamics of the modern world. Professionals that are self-sufficient and won’t go into paralysis when the DevOps is out on holiday. Ideally, any person in the team should fill any other role if needed - from small tweaks on the UI, to debugging the CI pipeline.

This is easier said than done, though. Acquiring the skills to be productive in multiple areas requires years. You also need to be exposed to different parts of the product. A company with strong silos between teams won’t give you that opportunity.

At the same time, when complex work needs to be done, a team of generalists may lack the experience to take proper decisions. When the database’s performance needs improvement or architectural decisions need to be made you need a person that’s deeply focused on that topic.

The evolution of software development methodologies required a new kind of engineers - specialised generalists.

Thus, the term “T-Shaped Specialist” was coined. It is used to describe a person whose knowledge distribution looks like the letter T. The horizontal line describes a broad working knowledge in multiple areas. The vertical one is for specialization in a topic.

A back end engineer who can put up their own interface, style it reasonably and deploy it may fall into that category. A UI engineer that can spin up an Express service when needed and can debug an API endpoint could also be considered T-Shaped.

Having a team of specialised generalists means that work can be prioritised without worrying about the available developers. This breaks the silos around teams and helps everyone to get more involved in the project.

Problems of T-Shaped Engineers

Having T-Shaped specialists is not a silver bullet. It doesn’t mean that anyone can do any job and do it well. While they have broad knowledge this doesn’t mean that they can perform exceptionally everywhere.

The business may sometimes falsely expect such engineers to be experts in everything. T-shaped engineers can adapt and get up to speed with different technologies. But they still have a main area of focus.

X650 | Development Kit » Carbon Fiber 650mm Frame » Foldable Arm Design » Minmal Assembly Time » No Soldering Required » 3.5kg Payload (w/ 5200mAh Lipo)

An ESPHome external component for monitoring and controlling GE appliances — and other appliances supporting the GEA bus — via the GEA2 or GEA3 serial bus, with native Home Assistant integration.

A plugin driven framework to build WYSIWYG Markdown editor.

CloudServer (formerly S3 Server) is an open-source object storage project to enable on-premises S3-based application development and data deployment choice.

1Password for Claude lets you authorize Claude to complete browser-based tasks that require an account login. This is useful for things like booking travel or managing online accounts.

According to 1Password, approved credentials are delivered through a secure channel and injected directly into the destination page. The password, one-time code, and other secrets never enter Claude’s context, memory, or Anthropic’s systems.

Instead of granting ongoing access to a vault, Claude requests the specific login items it needs for a task. The user can approve or deny that request with a biometric prompt, and the permission lasts only for the current session.

1Password can also broker access across multiple websites during the same task, allowing Claude to complete a multi-step workflow without stopping for a new login each time.

The launch also introduces what 1Password calls Agentic Mode.

When a compatible AI agent takes control of the browser, the 1Password extension automatically locks down the vault so that only the credentials explicitly approved for that task remain available.

It requires the 1Password desktop app and browser extension, along with the Claude desktop app and browser extension.

Support for payment cards and identity information is planned for a later update.

The Anthropic partnership was first outlined in March, when 1Password said Claude would gain consent-based access to vault items.

The Unified Interface For LLMs

OpenRouter charges a 5.5% ($0.80 minimum) fee when you purchase credits. We pass through the pricing of the underlying model providers without any markup, so you pay the same rate as you would directly with the provider.

if you choose to use your own provider API keys (Bring Your Own Key - BYOK), the first 1M BYOK requests per-month are free, and for all subsequent usage there is a fee of 5% of what the same model and provider would normally cost on OpenRouter. This fee is deducted from your OpenRouter credits.

Ultralytics creates cutting-edge, state-of-the-art (SOTA) YOLO models built on years of foundational research in computer vision and AI. Constantly updated for performance and flexibility, our models are fast, accurate, and easy to use. They excel at object detection, tracking, instance segmentation, semantic segmentation, image classification, and pose estimation tasks.

CVAT Community is the free, self-hosted open-source edition of CVAT — one of the most widely used data annotation platforms for building high-quality visual datasets for computer vision and visual AI. Since 2018, CVAT has become one of the best-known data annotation tools in computer vision, with a large open-source community, millions of Docker pulls, and broad adoption across research and production AI teams.

Turn raw visual data into model-ready datasets with CVAT annotation platform. Run it on your own infrastructure, CVAT cloud, or let our labeling team do the work.

Parse Platform is your complete backend solution for mobile and web applications. Deploy anywhere, scale infinitely, own your data.

OpenFGA takes the best ideas from Google's Zanzibar paper for Relationship-Based Access Control, and also solves problems for Role-based Access Control and Attribute-Based Access Control use cases. The modeling language is powerful enough for engineers, but friendly enough for other stakeholders on your team as well.