21 |Web3 & AI🤿|Arranging 0s and 1s in just the right order.🛠️
Joined March 2023
- Tweets 480
- Following 508
- Followers 1,673
- Likes 864
96 Photos and videos
Shon retweeted
9 Jul 2022
An underrated life hack:
Let everyone around you think that they are smarter than you
62
232
2,034
Shon retweeted
May 1
Take care of your appearance. Lift the weights. Eat healthy foods. Sleep like an athlete. Dress like you care. Fix your posture. Moisturize your face. Take care of your skin. Your looks are your business card. Make it look like you care about yourself.
109
928
7,933
146,989
Shon retweeted
6 Apr 2022
Do you want to be liked, or do you want to win?
686
789
6,819
Shon retweeted
Apr 24
Life is too short to worry about little things. Have fun. Fall in love. Regret nothing, and don't let people bring you down. Study, think, create, and grow. Teach yourself and teach others.
149
2,498
11,091
351,689
Someone published an npm package called everything that depends on every public npm package. Then tried to delete it. npm said no. Trapped by his own prank 💀
socket.dev/blog/when-everyth…
boehs.org/node/npm-everythin…
uncenter.dev/posts/npm-insta…
2
68
🤨 People keep asking how to protect yourself.
#1: set min-release-age=7 in .npmrc
#2: install Socket for GitHub (it's free!) to protect PRs from bad dependencies: socket.dev/features/github
#3: install Socket Firewall (also free!) to protect your laptop: socket.dev/features/firewall
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
57
283
2,419
347,609
Shon retweeted
Mar 31
very big breach
Mar 31
Mercor AI has allegedly been breached by Lapsus
939GB of source code
4TB of data in total
All data from their TailScale VPN
@mercor_ai
33
120
1,424
791,574
🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.
The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise.
This is textbook supply chain installer malware. axios has 100M weekly downloads. Every npm install pulling the latest version is potentially compromised right now.
Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:
• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence
If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.
541
4,026
16,167
12,404,783
Anthropic is now officially more open than OpenAI.
Mar 31
Claude code source code has been leaked via a map file in their npm registry!
Code: pub-aea8527898604c1bbb12468b…
1
60
Shon retweeted
8 Mar 2025
“Until death, all defeat is psychological”
361
16,842
70,707
25,726,372