A backdoor in a LinkedIn job offer - Roman Imankulov

kept by eddie jun 16

A fake recruiter sent a LinkedIn job candidate a GitHub repo with a backdoor that executes on npm install by running a remote-controlled command payload hidden in a test file.

Designing AI agents to resist prompt injection
OpenAI argues that defending against prompt injection in AI agents requires treating attacks as social engineering and designing systems to constrain impact rather than just filtering inputs.
also on #social-engineering, #security
The surprising attention on sprites, exe.dev, and shellbox - Lalit Maganti
New services like exe.dev, sprites, and shellbox succeed not on price or specs, but by offering frictionless, sandboxed cloud VMs for AI-driven developers who want fast prototyping and instant web service sharing.
also on Hetzner, #ai-coding, #developer-tools
I am building a cloud
exe.dev, co-founded by a Tailscale founder, offers SSH-accessible VMs for $20/month, aiming to simplify cloud infrastructure for AI agents.
also on Hetzner, #developer-tools
How to Evaluate an npm Package - 2026 Edition
A practical checklist for evaluating npm packages in 2026 covering security, maintenance, provenance, CI quality, and incident response to make informed dependency decisions.
also on npm, GitHub, #security, #developer-tools
GitHub - sindresorhus/np: A better `npm publish`
np enhances npm publish with interactive UI, safety checks, version bumping, tagging, and rollback features for reliable package releases for developers.
also on npm, GitHub, #developer-tools