I turn ideas into code and sketches into products. Dreamlab is the playground. I want to build something clever.
Amsterdam
Joined March 2011
- Tweets368
- Following354
- Followers41
- Likes988
I don’t build “features”.
I build systems that turn messy inputs into clear decisions.
Streaming, structured data, reviewer workflows
not chat demos, not UI polish for the sake of it
Less noise. More signal.
🤖 Made with AI
1
10
A lot of AI demos stop at:
“look, it answers”
That’s not enough.
Real value starts after the answer:
•can you trust it?
•can you inspect it?
•can you act on it?
1
4
A lot of AI demos stop at:
“look, it answers”
That’s not enough.
Real value starts after the answer:
•can you trust it?
•can you inspect it?
•can you act on it?
1
5
Artemis II is about to launch.
For the first time since Apollo, humans will orbit the Moon again.
This isn’t nostalgia.
It’s infrastructure.
Orion + SLS aren’t the goal, they’re the bridge.
The real objective is to stay.
Next stop: the lunar surface. 🌕
#ArtemisII #Moon
114
Luca Faccio retweeted
New supply chain attack this time for npm axios, the most popular HTTP client library with 300M weekly downloads.
Scanning my system I found a use imported from googleworkspace/cli from a few days ago when I was experimenting with gmail/gcal cli. The installed version (luckily) resolved to an unaffected 1.13.5, but the project dependency is not pinned, meaning that if I did this earlier today the code would have resolved to latest and I'd be pwned.
It's possible to personally defend against these to some extent with local settings e.g. release-age constraints, or containers or etc, but I think ultimately the defaults of package management projects (pip, npm etc) have to change so that a single infection (usually luckily fairly temporary in nature due to security scanning) does not spread through users at random and at scale via unpinned dependencies.
More comprehensive article:
stepsecurity.io/blog/axios-c…
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.