🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest axios@1.14.1 now pulls in plain-crypto-js@4.2.1, a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios has 100M weekly downloads. Every npm install pulling the latest version is potentially compromised right now. Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that: • Deobfuscates embedded payloads and operational strings at runtime • Dynamically loads fs, os, and execSync to evade static analysis • Executes decoded shell commands • Stages and copies payload files into OS temp and Windows ProgramData directories • Deletes and renames artifacts post-execution to destroy forensic evidence If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

Hiring another senior, full-stack, founding engineer Name your salary, and if you're legendary, I'll do everything I can to meet it If you want to build cool shit, with huge creators Work super hard but have a shitload of fun doing it, keep reading

After two years of work, I can FINALLY announce my newest project with @StevenBartlett: @Flightcast_ Upload video podcasts to YouTube & Spotify Audio everywhere else Get all your video audio analytics in one place Then analyze your data with an AI assistant

A massive supply chain attack just hit the JavaScript ecosystem. 18 core NPM packages were hacked, including chalk, strip ansi and debug. These libraries have over 2 billion weekly downloads. Here’s what happened, how it affects crypto and how to stay safe 🧵 (1/8)

✨ Big O ✨ Let me take you on a visual introduction to what big O notation is in my new blog post: samwho.dev/big-o. With big O notation you can better understand how algorithms will perform, finding orders of magnitude improvements with very simple changes to your code

I think it's time to share this again.

In response to an email in which someone asked me about what I've seen work with agentic engineering.

I see. In that case, I suggest NOT starting with shadcn/ui. Start here instead: 1. Build a simple component with React. Most probably a form. 2. Use the default input and button component. Make it work. 3. Realize the default button doesn’t look that great. 4. Add some Tailwind classes to the button, padding, font size, colors, just enough to make decent. 5. Add a second button, maybe a "Reset" or "Cancel". Style it. Keep building. 6. You'll start seeing a pattern. Repeating classes and props. 7. Move your two buttons to components/ui/button.tsx. Import and use in your form. 8. You now have a reusable button.tsx styled with Tailwind. Keep building. 9. Do the same for input, textarea and so on. 10. You're now building shadcn/ui. Once you’ve done this, you’ll get it. For your next project, instead of doing the above again, you just run the following. It’s the exact same thing. > npx shadcn add button input textarea

we built an open-source database of AI models it includes things like pricing and limits - opencode uses this under the hood it even has an api if you want to integrate it yourself give it a star and help contribute - link in reply

hiring a founding fullstack engineer if you want to build cool shit, with huge creators, work super hard but have a shitload of fun doing it, keep reading

My goal for the past month was to build a gamified, time-tracking app, that makes it super fun to work on your projects. I'm happy to announce that: The app is now live! 🥳 I never had as much fun working on my projects while earning badges, growing my streak, and competing with others!

I've written an interactive post explaining Bloom Filters for folks that don't know how they work! They're a very cool data structure 😁 samwho.dev/bloom-filters

What does it mean for something to be Turing complete? I answer this question with a series of interactive Turing machine simulations! Play, pause, step forwards and backwards, and even write your own Turing machine programs in my latest blog post. samwho.dev/turing-machines/

Just had a fascinating lunch with a 22-year-old Stanford grad. Smart kid. Perfect resume. Something felt off though. He kept pausing mid-sentence, searching for words. Not complex words - basic ones. Like his brain was buffering. Finally asked if he was okay. His response floored me. "Sometimes I forget words now. I'm so used to having ChatGPT complete my thoughts that when it's not there, my brain feels... slower." He'd been using AI for everything. Writing, thinking, communication. It had become his external brain. And now his internal one was getting weaker. Made me think about calculators. Remember how teachers said we needed to learn math because "you won't always have a calculator"? They were wrong about that. But maybe they were right about something deeper. We're running the first large-scale experiment on human cognition. What happens when an entire generation outsources their thinking? Don’t get me wrong, I’m beyond excited about what AI and AI agents will do for people in the same way that I was excited in 2009 when the App Store was launched. But thinking out loud you got to think this guy I met with isn't the onnnnnly one that's going to be completely dependent on AI.

found this hilarious meme 😂

Due to a family emergency, one of my team members has to leave the company - so I'm hiring again. I need someone replace an infra legend. founding eng. mostly cf, Next/ts web, some go low salary, high equity i will fight to make you a millionaire in two years infra@rox.codes

My queueing post is still my favourite piece of content I’ve ever written, and hasn’t gotten close to the amount of love some my other posts have gotten. encore.dev/blog/queueing

👋 Hey streamer friends! There is a reason so many streamers out there struggle to retain and grow their community. And it has nothing to do with “making good content” or “being entertaining.” Here is our reality: we have no support when it comes to cultivating community. 🧵

🎉 High Performance SQLite is live! This video course covers everything you need to know about SQLite. It's 65 videos across 6 modules, with at least 20 more videos to come. We're launching in early access today, so the price is currently discounted! Y'all go get it!

With the money I made from my stream last month, I was able to book a recording session for two musicians at a local studio last night I met them both through my piano club, and kept begging them to record their stuff—no more! This is all thanks to you, chat 💛 #buildinpublic