Oxana Willeke has built a career around that gap. A former recruiter, technology professional, and now executive career coach based in the Greater Seattle Area, she works with senior leaders across every industry, with particular depth in tech and climate, professionals who are polished on paper and invisible in practice. Named among Influence Digest’s Top Career Coaches in Seattle for 2025, her insight comes from sitting on both sides of the hiring table, and concluding that the real shortage isn’t talent. It’s visibility.

Her work carries a personal edge, too. She has a particular affinity for coaching international professionals and executives in transition, having navigated both herself. When a client is starting over in a new country, a new industry, or after a layoff, Oxana isn’t working from theory, she’s working from experience.

Her own career taught her this before she coached anyone through it. After moving to the U.S. from Novosibirsk, Siberia, she watched applications disappear into silence, until a mentor at the University of Washington told her to stop applying and start talking to people. A conversation at a gaming conference led to an introduction, and eventually her first U.S. role at Big Fish Games. The lesson stuck: relationships open doors that resumes can’t.

Drawing on a background in project management, Oxana built Path to Placement, a six-step private coaching program that takes clients from career direction through brand-building, networking, resume and LinkedIn optimization, interview prep, and negotiation. It exists to replace what she saw repeatedly: talented people burning out on volume, hundreds of applications, no traction, because effort without direction doesn’t convert.

Oxana’s reach extends past private clients. As a National Speakers Association member, she delivers keynote presentations and webinars, including “How to Beat the Application Tsunami” and “Supercharge Your LinkedIn”, and writes regularly on interview prep, LinkedIn strategy, and AI’s growing role in recruitment. She’s also active with Climatebase, where she completed a Fellowship with distinction and facilitated mastermind groups for professionals entering the climate sector. Careers grow through community, not in isolation.

The Oxana Willeke Playbook: 5 Lessons for Building a Career That Gets Noticed

• 1. Start with clarity: Where do you see yourself next? What are your dream companies? A deep, targeted approach beats “spray and pray” every time.
• 2. Optimize application materials: Focus your résumé and LinkedIn around measurable impact, not job descriptions.
• 3. Leverage existing networks: Expand your network strategically. Relationships don’t just support the search, they often are the search.
• 4. Track every step: Treat your job search like a project with milestones and accountability, not a waiting game.
• 5. Become a LinkedIn subject matter expert: Visibility compounds—the goal is to be sought after, not to keep searching.

Tauri is a framework for building tiny, fast binaries for all major desktop and mobile platforms. Developers can integrate any frontend framework that compiles to HTML, JavaScript, and CSS for building their user experience while leveraging languages such as Rust, Swift, and Kotlin for backend logic when needed.

Fighting air inequality through
open data.

OpenAQ is a nonprofit organization providing universal access to air quality data to empower a global community of changemakers to solve air inequality—the unequal access to clean air.

Gas or propane stoves, lanterns, or heating devices are permitted in campgrounds and wilderness areas if there is no flammable material within three feet of the device. These stoves must be equipped with an on-off switch or valve capable of immediately extinguishing the flame. Extreme caution is urged with any open flame.

zot: a production-ready vendor-neutral OCI image registry - images stored in OCI image format, distribution specification on-the-wire, that's it!

⚡️ Docusaurus will help you ship a beautiful documentation site in no time.

💸 Building a custom tech stack is expensive. Instead, focus on your content and just write Markdown files.

flagd is a feature flag evaluation engine. Think of it as a ready-made, open source, OpenFeature-compliant feature flag backend system.

With flagd, you can:

• modify flags in real-time
• define flags of various types (boolean, string, number, JSON)
• use context-sensitive rules to target specific users or user traits
• perform pseudorandom assignments for experimentation
• perform progressive roll-outs of new features
• aggregate flag definitions from multiple sources
• expose aggregated flags as a gRPC stream to be used by in-process providers
• expose OFREP service for configured flags

It doesn't include a UI, management console or a persistence layer. It's configurable entirely via a POSIX-style CLI. Thanks to its minimalism, it's extremely flexible; you can leverage flagd as a sidecar alongside your application, an engine running in your application process, or as a central service evaluating thousands of flags per second.

Contracting. They have a project-based work force and assign people to orgs.

Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major enterprise software ecosystems such as keyv, flat-cache, cache-manager, and others. The malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload. The malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes.

Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for npm, GitHub, cloud, and infrastructure credentials. It uses recovered identities to authenticate to npm, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values. Collected data is encrypted and transmitted through an attacker-controlled HTTPS endpoint, with GitHub repositories serving as a fallback exfiltration channel.

The payload’s most significant capability is automated propagation. After obtaining an npm publishing token, it enumerates packages available to the compromised identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, and republishes the modified packages. The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path.

In this blog, we’re sharing our analysis of this supply chain attack, along with protection, detection, amd hunting guidance. Organizations that installed an affected package with lifecycle scripts enabled should treat the associated developer workstation or build runner as potentially compromised. Investigations should prioritize credentials accessible to the affected identity, unauthorized npm releases, unexpected repository or workflow modifications, suspicious cloud and secret-store access, and artifacts produced by affected build systems. Organizations should revoke and rotate exposed credentials from a known-clean environment and rebuild affected systems and downstream artifacts from trusted sources.

Evidence points towards stolen maintainer credentials as the attack vector for initial compromise. Later propagation used stolen npm publishing tokens and, in targeted workflows, GitHub Actions OIDC publishing access.

• One worm took twelve unrelated organisations between 09:35 and 13:18 UTC on 4 August 2026, each republishing its whole namespace within seconds.

• The confirmed footprint is 2,234 poisoned versions across 444 package names. latest still resolves to a poisoned version on most affected names, so upgrading is not a fix. The maintainers have since cleaned the keyv and cacheable family and unpublished its poisoned releases, which does not help a lockfile pinned while they were live.

• Every poisoned release adds "preinstall": "node setup.mjs", which runs on a bare npm install. Disable install scripts in CI, and treat any npm token used in CI during the window as compromised.

• The payload steals GitHub, npm, AWS, GCP, Azure, Stripe, Vault and Kubernetes credentials, scrapes GitHub Actions runner memory, and can republish packages with valid SLSA provenance.

• It installs a dead-man’s switch that polls GitHub with the stolen token and executes a handler when that token is revoked. Hunt it before rotating anything, because rotation is the trigger.

• Poisoned packages include the auth libraries @or-sdk/auth, @or-sdk/api-tokens, @or-sdk/permissions and @arv-bedrock/auth. The @ornikar packages are mostly lint and build configs, which land on CI runners and developer laptops as dev dependencies.

• There is no C2 host. Exfiltration rides GitHub dead-drop repositories and Actions artifacts under RSA-4096 encryption, and stage one pulls its runtime from the official Bun releases, so no attacker domain appears at either stage.

• 546 dead-drop repositories described Shai-Hulud: Here We Go Again appeared on 4 August 2026, and the same marker appears on the TanStack compromise dated 11 May 2026.

• The keyv repository also ships .claude/settings.json and .vscode/tasks.json hooks that execute when the project opens in an IDE or agent session. Both are still on main.

• The commit that added those hooks shows as verified by GitHub with its author spoofed to github-actions[bot], and the poisoned keyv release carries intact OIDC and SLSA attestation. Trust neither signal here.

The Baochip-1x is an SoC with enhanced open source and security features. Fabricated in TSMC22ULL, it has a 350MHz Vexriscv RV32-IMAC CPU with Sv39 (virtual memory) support, along with 2MiB of integrated SRAM and 4MiB of integrated RRAM. RRAM is non-volatile memory analogous to FLASH.

The full part number is BAO1X2S4F-WA, but the part is referred to as the “Baochip-1x” or the “bao1x” interchangeably.

Hosts TSConfigs for you to extend in your apps, tuned to a particular runtime environment. Owned and improved by the community. Basically Definitely Typed for TSConfigs.

Mailpit - email & SMTP testing tool with API for developers

Mailpit is a small, fast, low memory, zero-dependency, multi-platform email testing tool & API for developers.

It acts as an SMTP server, provides a modern web interface to view & test captured emails, and contains an API for automated integration testing (read more).

FlyDrive is a file storage library for Node.js. It provides a unified API to interact with the local file system and cloud storage solutions like S3, R2, and GCS.

Drive can be an excellent fit for applications that use cloud storage services to manage user-uploaded files. With Drive:

• You get a unified API for various storage services, including S3, R2, Digital Ocean spaces, GCS, and your local file system.
• Extensible API to add custom storage drivers.
• Unified exception handling.
• Baked-in security primitives to prevent common attacks like Path travesal.

A simulated bash environment with virtual filesystem

The self-hostable alternative to Dropbox and Google Drive. Upload, organize, and share files from your own infrastructure.

Bring your own storage — local disk, S3, R2, or Vercel Blob. One env var to switch. Full type-safe API with tRPC.

Very cool.

Next.js 16 with App Router, PostgreSQL with Drizzle ORM, tRPC for type-safe APIs, BetterAuth for authentication, and Tailwind CSS for the UI. The project uses a Turborepo monorepo with pnpm workspaces.

Oof. This Vercel-based stack is hard for me to swallow.

Multi-Store Replication

Attach multiple storage backends per workspace. Designate a primary store, fan out writable replicas for redundancy, and ingest files from read-only sources.

Neat. Almost no backup needed.

Search Inside Images & PDFs

Find files by what's in them, not just the name. Locker transcribes images and PDFs into searchable text so every document is discoverable.

Smart.

Virtual Bash Shell

Navigate your files with familiar commands. Use ls, cd, find, cat, and grep through a virtual filesystem API.

Love the idea of this, but it's not a CLI per se, it's an API you can use via tRPC.

MLX is an array framework for machine learning on Apple silicon, brought to you by Apple machine learning research.

Some key features of MLX include:

• Familiar APIs: MLX has a Python API that closely follows NumPy. MLX also has fully featured C++, C, and Swift APIs, which closely mirror the Python API. MLX has higher-level packages like mlx.nn and mlx.optimizers with APIs that closely follow PyTorch to simplify building more complex models.

• Composable function transformations: MLX supports composable function transformations for automatic differentiation, automatic vectorization, and computation graph optimization.

• Lazy computation: Computations in MLX are lazy. Arrays are only materialized when needed.

• Dynamic graph construction: Computation graphs in MLX are constructed dynamically. Changing the shapes of function arguments does not trigger slow compilations, and debugging is simple and intuitive.

• Multi-device: Operations can run on any of the supported devices (currently the CPU and the GPU).

• Unified memory: A notable difference from MLX and other frameworks is the unified memory model. Arrays in MLX live in shared memory. Operations on MLX arrays can be performed on any of the supported device types without transferring data.

MLX is designed by machine learning researchers for machine learning researchers. The framework is intended to be user-friendly, but still efficient to train and deploy models. The design of the framework itself is also conceptually simple. We intend to make it easy for researchers to extend and improve MLX with the goal of quickly exploring new ideas.

The design of MLX is inspired by frameworks like NumPy, PyTorch, Jax, and ArrayFire.

The Manitoba RCMP say they’re not aware of any emergency response that was negatively impacted by the 911 outage that lasted approximately two hours on Wednesday afternoon.

In Brandon, Mayor Jeff Fawcett says they were able to mitigate the interruption with their backup software called RapidSOS.