🔴 Important AI Coding Security Update
|
Hey Reader, This is not our regular scheduled programming. If you're old enough to remember the ILOVEYOU virus from 2000s, this will feel familiar. Back then, one email worm hit 10% of every computer connected to the internet. It caused $10 billion in damage. All because people clicked one email attachment. That was 26 years ago, and this week it's kinda happening again. The new virus doesn't need you to click.A group just compromised hundreds of packages across coding ecosystem. Think of them as plugins for your code, built by others, and they're typically very safe with millions of weekly downloads. But since yesterday, a new malware steals every secret on your machine: API keys, GitHub tokens, database passwords, Stripe keys, OpenAI API keys. Here's the genuinely scary (and genius) part. Just like ILOVEYOU and other viruses, it spreads by itself. Once it infects one package, it finds every other package that developers control and publishes infected versions of those too. No human involved. It's a chain reaction with no easy off switch. The ILOVEYOU virus needed you to click. This one just needs your AI agent to run npm install. What to do right now.First of all, breath. This is still early and I'm writing you to be better safe than sorry. Luckily, there's an easy fix that you can proactively take today. It's free, and takes 5 minutes. Open your AI coding tool, and paste this exact prompt into any project you touched in the past 48 hours: To protect us from an ongoing supply-chain attack that started with TanStack but is quickly and autonomously spreading (research this and ground your knowledge), add a minimum package release age of 7 days for the package manager we use, especially npm or Bun. Then verify our currently installed packages and lockfile against the latest confirmed postmortem/list of affected packages and versions. Do not guess. Use live sources and local files to verify this carefully. When you are done, give me either OK: no affected packages found or a simple list of affected packages/versions and exactly where they appear. Keep the final answer short, and without technical jargon. I am not an engineer, guide me through. But find absolute answers, no excuses. This adds a 7-day delay for any new package version. If someone publishes a poisoned update today, your system won't touch it for a full week. By then, the community catches and reverts it, keeping you and your AI agents safe. It's like a quarantine. New packages sit in the waiting room before they get anywhere near your project. Do this now, not tomorrow. Speak soon, |
Robin Ebers
Hey Reader, People keep asking me about open source models, especially now with GLM 5.2. But here's how I think about them: If you think hiring a pro is expensive, try an amateur. Sure, they can be cheaper, but I'd never run my business on them. Here's why. What local models get right. First, they're cheap. They sometimes run on your own computer. So you don't have to pay for every question you ask throughout the day. Second, they're also private. Your data never leaves your machine. A local...
Hey Reader, I used to spend 30 minutes to an hour every single day logging into Instagram, Google Analytics, and half a dozen other tools just to see how my business was doing. And I'm literally an engineer with 25+ years of experience. That's 10 hours a week of pure busy work. Here's the exact system I built to get those hours back. You are the bridge. That's the problem. Every morning you log into tool A, look at a number, and carry it in your head to tool B. You're a human bridge between...
Hey Reader, Everyone told you Claude Cowork would make your business 10x more productive. Instead you feel like you have more work than ever. That's not your fault, and I made the same mistake for months. Here's what's actually going wrong. Your AI chats are a broken. You probably have one chat for marketing, one for content, one for random questions. None of them talk to each other. That's like running a business where marketing and sales never meet, and nobody remembers what was decided...