Imagine a world where you could copy/paste websites into editable Figma layers (jk you don’t have to imagine you can do this now with our Chrome extension)

‼️🚨 UPDATE: The TanStack npm attack is now a full campaign. 'Mini' Shai-Hulud has hit: - OpenSearch - Mistral AI - Guardrails AI -UiPath - Squawk packages across npm and PyPI The malware specifically targets AI developer tooling. It hooks into Claude Code (.claude/settings.json) and VS Code (.vscode/tasks.json) to re-execute on every tool event, long after the infected package is gone. npm uninstall does not fix this.

‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you. The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads. The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate. Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.

My leader @ImranKhanPTI sits in jail with his health in jeopardy. His imprisonment weighs on us every day. But I know him well enough to say this: He would want Pakistan's young people to keep building, to take on the world. Especially in AI. Especially now, without losing sight of the political struggle, which we will not abandon. This thread is for them 🧵 — Forced to stay away from my country gave me two benefits: More time and more passion. I chose not to waste either. This is a personal account: It started with my need to transcribe my long speeches, some over thirty minutes, in mixed English and Urdu on YouTube (which gave a Hindi/Sanskrit transcript). The platforms available would do a bad job with the mix. So, I asked my coaches — ChatGPT, Claude & Gemini and I concluded to do it myself, locally, with Whisper’s large, medium & small models and other AI tools. This was completed in Dec ‘25 For the sake of open source and transparency, I am publishing it on GitHub. github.com/DrArifAlvi/youtub… In January ’26, I began building the Dr Arif Alvi AI Archive. An attempt to bring together everything I had said, written, read, and recorded across decades, and make it searchable, synthesizable, MINE. I built it alone. No team. No budget. Just time, curiosity, and persistence. It runs entirely on my enhanced laptop. My data never leaves it. My AI agents ingest my writings/articles; thousands of books read and summarised; millions of words of archival material; my thousands of speeches on YouTube press conferences; thousands of talk show appearances since 2000 and clips on YouTube. All scraped from the net via APIs— indexed, and alive inside my local RAG (Retrieval Augmented Generation) system that answers back. My 50,000 tweets are searchable faster than X's own tools. Not just by keyword but semantically. None of it leaves my computer or enters the public domain, remains private. — The local LLMs answer questions, draft research briefs, synthesize across all data. When I need to reach beyond my own archive, they augment from public LLMs — ChatGPT, Claude, DeepSeek, others. I use the archive every day, updating it regularly. It has changed how I think and work. — Following are the layers of the stack — what I built is one-of-one. But what I built it from is available to every-one: ▶️ Ollama / Llama / Phi / Qwen — local LLMs running entirely on-device ▶️ Whisper — bilingual English-Urdu speech transcription ▶️ ChromaDB — vector memory across 70,000 chunks ▶️ Sentence Transformers — semantic search across tweets, speeches, and archives ▶️ Streamlit — dashboard with dual modes: semantic search and AI research ▶️ Six LLM interfaces (ChatGPT, Claude, DeepSeek, Gemini, Perplexity, Copilot) for python scripts and for augmentation of local output ▶️ OpenClaw and GitHub — for code management ▶️VS Code — for scripts and code writing None of them are mine. The COMPOSITION is mine. — I should tell you what it took to get here. I started learning Python basics from online courses. I am not a programmer, but I reviewed and iterated over a million lines of scripts —learning, correcting, improving, understanding—just enough to keep going. I had launched Pakistan's Presidential Initiative on Artificial Intelligence in 2019. I thought I understood AI but I took advanced courses anyway. There is always more to learn, and humility about ignorance is not a weakness. It is the only honest starting point. — There are tens of thousands of students, researchers, operators, lawyers, and doctors across Pakistan and the world, quietly trying to dabble in AI right now. To them I would say: software writing is mostly done by machines today. You do not need to become a programmer. You need to understand enough to read, direct, correct and employ tools — like a symphony conductor, with an AI baton. More than anything, pick a project. Something real, something yours.🔑 Scripts fill the architecture. Concrete fills the blueprint. GET TO WORK And do not move slowly. AI tools and agentic systems are changing every single day. What was remarkable yesterday is ordinary today. Sometimes the gap is hours, not months. The people who stay ahead are not waiting to fully understand it before they begin. THEY ARE ALREADY BUILDING. — Pakistan cannot afford to fall behind in this. Not out of nostalgia for what Pakistan was, but out of economic and strategic urgency for what it must become — because our talented, hungry people can build anything when given the tools and the leadership. This is for them. START

prediction: no one will ship a github alternative no new startup, nor existing series C / beyond not linear, not vercel, not cloudflare :(

how to cold DM anyone: complete basics 00:00 Why I love cold emails 02:36 Inbound vs creating your own luck 03:52 Should you use AI to write your DMs? 04:33 The 5-part subject line rubric 06:13 The cold email Mark Cuban replied to 12:18 The Lovable email everyone responds to 13:18 You want a hell yes or a no 13:39 The hedge that kills your reply rate 14:29 Leading with negative curiosity 18:10 Optimize your email for someone's AI inbox 19:59 Pop quiz: which subject line do you reply to? 22:38 If you want an investor to open it, mention another investor 27:25 Match the message to the GP, not the analyst 35:08 "yo bro wanna collab" is terrible 35:48 Your message is way too long 36:24 Burying your ask 38:30 Following up after a hard no 39:37 The mistake of making it all about you 40:18 Email Bible vs Twitter Bible vs LinkedIn Bible 40:40 Set a rule 42:07 Personalization? 43:28 The 3 questions to answer before sending

If you want a rare life, you have to be delusional. Doubt can enter your mind, and it can sound reasonable, but if you entertain it too much it will slowly drag you down into stagnation. I'd rather reap the lesson from massive failure than do nothing because it's not "realistic."

A quick @code tip you may not know: you can select bracket and string content with a simple double-click 🖱️