⚡️ Docusaurus will help you ship a beautiful documentation site in no time.

💸 Building a custom tech stack is expensive. Instead, focus on your content and just write Markdown files.

flagd is a feature flag evaluation engine. Think of it as a ready-made, open source, OpenFeature-compliant feature flag backend system.

With flagd, you can:

• modify flags in real-time
• define flags of various types (boolean, string, number, JSON)
• use context-sensitive rules to target specific users or user traits
• perform pseudorandom assignments for experimentation
• perform progressive roll-outs of new features
• aggregate flag definitions from multiple sources
• expose aggregated flags as a gRPC stream to be used by in-process providers
• expose OFREP service for configured flags

It doesn't include a UI, management console or a persistence layer. It's configurable entirely via a POSIX-style CLI. Thanks to its minimalism, it's extremely flexible; you can leverage flagd as a sidecar alongside your application, an engine running in your application process, or as a central service evaluating thousands of flags per second.

Contracting. They have a project-based work force and assign people to orgs.

Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major enterprise software ecosystems such as keyv, flat-cache, cache-manager, and others. The malicious releases contain a Mini Shai-Hulud variant, a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload. The malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes.

Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for npm, GitHub, cloud, and infrastructure credentials. It uses recovered identities to authenticate to npm, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values. Collected data is encrypted and transmitted through an attacker-controlled HTTPS endpoint, with GitHub repositories serving as a fallback exfiltration channel.

The payload’s most significant capability is automated propagation. After obtaining an npm publishing token, it enumerates packages available to the compromised identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, and republishes the modified packages. The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path.

In this blog, we’re sharing our analysis of this supply chain attack, along with protection, detection, amd hunting guidance. Organizations that installed an affected package with lifecycle scripts enabled should treat the associated developer workstation or build runner as potentially compromised. Investigations should prioritize credentials accessible to the affected identity, unauthorized npm releases, unexpected repository or workflow modifications, suspicious cloud and secret-store access, and artifacts produced by affected build systems. Organizations should revoke and rotate exposed credentials from a known-clean environment and rebuild affected systems and downstream artifacts from trusted sources.

Evidence points towards stolen maintainer credentials as the attack vector for initial compromise. Later propagation used stolen npm publishing tokens and, in targeted workflows, GitHub Actions OIDC publishing access.

• One worm took twelve unrelated organisations between 09:35 and 13:18 UTC on 4 August 2026, each republishing its whole namespace within seconds.

• The confirmed footprint is 2,234 poisoned versions across 444 package names. latest still resolves to a poisoned version on most affected names, so upgrading is not a fix. The maintainers have since cleaned the keyv and cacheable family and unpublished its poisoned releases, which does not help a lockfile pinned while they were live.

• Every poisoned release adds "preinstall": "node setup.mjs", which runs on a bare npm install. Disable install scripts in CI, and treat any npm token used in CI during the window as compromised.

• The payload steals GitHub, npm, AWS, GCP, Azure, Stripe, Vault and Kubernetes credentials, scrapes GitHub Actions runner memory, and can republish packages with valid SLSA provenance.

• It installs a dead-man’s switch that polls GitHub with the stolen token and executes a handler when that token is revoked. Hunt it before rotating anything, because rotation is the trigger.

• Poisoned packages include the auth libraries @or-sdk/auth, @or-sdk/api-tokens, @or-sdk/permissions and @arv-bedrock/auth. The @ornikar packages are mostly lint and build configs, which land on CI runners and developer laptops as dev dependencies.

• There is no C2 host. Exfiltration rides GitHub dead-drop repositories and Actions artifacts under RSA-4096 encryption, and stage one pulls its runtime from the official Bun releases, so no attacker domain appears at either stage.

• 546 dead-drop repositories described Shai-Hulud: Here We Go Again appeared on 4 August 2026, and the same marker appears on the TanStack compromise dated 11 May 2026.

• The keyv repository also ships .claude/settings.json and .vscode/tasks.json hooks that execute when the project opens in an IDE or agent session. Both are still on main.

• The commit that added those hooks shows as verified by GitHub with its author spoofed to github-actions[bot], and the poisoned keyv release carries intact OIDC and SLSA attestation. Trust neither signal here.

The Baochip-1x is an SoC with enhanced open source and security features. Fabricated in TSMC22ULL, it has a 350MHz Vexriscv RV32-IMAC CPU with Sv39 (virtual memory) support, along with 2MiB of integrated SRAM and 4MiB of integrated RRAM. RRAM is non-volatile memory analogous to FLASH.

The full part number is BAO1X2S4F-WA, but the part is referred to as the “Baochip-1x” or the “bao1x” interchangeably.

Hosts TSConfigs for you to extend in your apps, tuned to a particular runtime environment. Owned and improved by the community. Basically Definitely Typed for TSConfigs.

Mailpit - email & SMTP testing tool with API for developers

Mailpit is a small, fast, low memory, zero-dependency, multi-platform email testing tool & API for developers.

It acts as an SMTP server, provides a modern web interface to view & test captured emails, and contains an API for automated integration testing (read more).

FlyDrive is a file storage library for Node.js. It provides a unified API to interact with the local file system and cloud storage solutions like S3, R2, and GCS.

Drive can be an excellent fit for applications that use cloud storage services to manage user-uploaded files. With Drive:

• You get a unified API for various storage services, including S3, R2, Digital Ocean spaces, GCS, and your local file system.
• Extensible API to add custom storage drivers.
• Unified exception handling.
• Baked-in security primitives to prevent common attacks like Path travesal.

A simulated bash environment with virtual filesystem

The self-hostable alternative to Dropbox and Google Drive. Upload, organize, and share files from your own infrastructure.

Bring your own storage — local disk, S3, R2, or Vercel Blob. One env var to switch. Full type-safe API with tRPC.

Very cool.

Next.js 16 with App Router, PostgreSQL with Drizzle ORM, tRPC for type-safe APIs, BetterAuth for authentication, and Tailwind CSS for the UI. The project uses a Turborepo monorepo with pnpm workspaces.

Oof. This Vercel-based stack is hard for me to swallow.

Multi-Store Replication

Attach multiple storage backends per workspace. Designate a primary store, fan out writable replicas for redundancy, and ingest files from read-only sources.

Neat. Almost no backup needed.

Search Inside Images & PDFs

Find files by what's in them, not just the name. Locker transcribes images and PDFs into searchable text so every document is discoverable.

Smart.

Virtual Bash Shell

Navigate your files with familiar commands. Use ls, cd, find, cat, and grep through a virtual filesystem API.

Love the idea of this, but it's not a CLI per se, it's an API you can use via tRPC.

MLX is an array framework for machine learning on Apple silicon, brought to you by Apple machine learning research.

Some key features of MLX include:

• Familiar APIs: MLX has a Python API that closely follows NumPy. MLX also has fully featured C++, C, and Swift APIs, which closely mirror the Python API. MLX has higher-level packages like mlx.nn and mlx.optimizers with APIs that closely follow PyTorch to simplify building more complex models.

• Composable function transformations: MLX supports composable function transformations for automatic differentiation, automatic vectorization, and computation graph optimization.

• Lazy computation: Computations in MLX are lazy. Arrays are only materialized when needed.

• Dynamic graph construction: Computation graphs in MLX are constructed dynamically. Changing the shapes of function arguments does not trigger slow compilations, and debugging is simple and intuitive.

• Multi-device: Operations can run on any of the supported devices (currently the CPU and the GPU).

• Unified memory: A notable difference from MLX and other frameworks is the unified memory model. Arrays in MLX live in shared memory. Operations on MLX arrays can be performed on any of the supported device types without transferring data.

MLX is designed by machine learning researchers for machine learning researchers. The framework is intended to be user-friendly, but still efficient to train and deploy models. The design of the framework itself is also conceptually simple. We intend to make it easy for researchers to extend and improve MLX with the goal of quickly exploring new ideas.

The design of MLX is inspired by frameworks like NumPy, PyTorch, Jax, and ArrayFire.

The Manitoba RCMP say they’re not aware of any emergency response that was negatively impacted by the 911 outage that lasted approximately two hours on Wednesday afternoon.

In Brandon, Mayor Jeff Fawcett says they were able to mitigate the interruption with their backup software called RapidSOS.

Install:

cd ~
sudo apt-get update
sudo apt-get install -y git python3-pip
pip3 install --upgrade adafruit-python-shell click Flask-SQLAlchemy
git clone https://github.com/adafruit/Raspberry-Pi-Installer-Scripts.git
cd Raspberry-Pi-Installer-Scripts

If you want to mirror the HDMI output to the display, known as “FrameBuffer Copy” or FBCP for short, use one of the following commands:

For the PiTFT 3.5" Resistive touchscreen, use the following command:

sudo -E env PATH=$PATH python3 adafruit-pitft.py --display=35r --rotation=90 --install-type=mirror

40-pin GPIO header pinout here.

Is this not the cutest, little display for the Raspberry Pi? It features a 3.5" display with 480x320 16-bit color pixels and a resistive touch overlay so is slightly larger than our popular original. The plate uses the high speed SPI interface on the Pi and can use the mini display as a console, X window port, displaying images or video etc. Best of all it plugs right in on top!

This PiTFT 3.5" is designed to fit nicely onto the original Pi 1 Model A or B but also works OK with the Raspberry Pi Zero, 4, 3, 2 Model B or Pi Model A+ or B+ as long as you don't mind the PCB overhangs the USB ports by 5mm.

Uses the hardware SPI pins (SCK, MOSI, MISO, CE0, CE1) as well as GPIO #25 and #24. GPIO #18 can be used to PWM dim the backlight if you like. All other GPIO are unused. There's a 2x13 header on the bottom, you can connect a standard Pi GPIO cable to it to use any of the other pins ask you like.

Best of all, it comes fully assembled and ready to plug into your Pi! You can use this as a display for running the X interface, or pygame. You can also have an HDMI display seperately connected. There's four mounting ears that can be used to attach the display & Pi to a bezel, or snap them off with pliers (they're perforated) for a slick exactly-the-same-size-as-a-Pi look.

Very interesting that these guys use the open-source parse server but host it for you.

At 9:20:

So for example, I'll give you at LinkedIn we used to have product managers, we had designers, we had front-end engineers and then we had back-end engineers and so on. So what we did is we sort of took those first four roles and combined them. In fact, increased scope and said, let's they're all full stack builders. So I like that because that's a structural change that allows for us to increase the change both the work and the workflow between these functions.

at the same time as you can imagine if to build an AI product today there's a complete new workflow right it starts with eval right so basically there's this eval to science to infrastructure and so eval are done by these full stack builders and what have you and product managers in the new form. The infrastructure is built by the systems engineers at the back end because they support the science that supports the product.

So in some sense there's a new loop uh and you have to structurally change and so a lot of what is happening inside a tech is that change uh which is I think going to be pretty massive uh and at the same time a company like ours I have to do everything it's not like I can just so go live in the future I have to make sure we're doing a fantastic job of doing hot patching on Windows is done with quality uh while at the same time building the evals that are improving co-pilot quality right and so both of those have to be first class. – Satya Nadella