Hey Reader,

This is not our regular scheduled programming.

If you're old enough to remember the ILOVEYOU virus from 2000s, this will feel familiar.

Back then, one email worm hit 10% of every computer connected to the internet.

It caused $10 billion in damage. All because people clicked one email attachment.

That was 26 years ago, and this week it's kinda happening again.

The new virus doesn't need you to click.

A group just compromised hundreds of packages across coding ecosystem. Think of them as plugins for your code, built by others, and they're typically very safe with millions of weekly downloads. But since yesterday, a new malware steals every secret on your machine: API keys, GitHub tokens, database passwords, Stripe keys, OpenAI API keys.

Here's the genuinely scary (and genius) part.

Just like ILOVEYOU and other viruses, it spreads by itself. Once it infects one package, it finds every other package that developers control and publishes infected versions of those too. No human involved. It's a chain reaction with no easy off switch.

The ILOVEYOU virus needed you to click. This one just needs your AI agent to run npm install.

What to do right now.

First of all, breath. This is still early and I'm writing you to be better safe than sorry.

Luckily, there's an easy fix that you can proactively take today. It's free, and takes 5 minutes.

Open your AI coding tool, and paste this exact prompt into any project you touched in the past 48 hours:

This adds a 7-day delay for any new package version. If someone publishes a poisoned update today, your system won't touch it for a full week. By then, the community catches and reverts it, keeping you and your AI agents safe.

It's like a quarantine. New packages sit in the waiting room before they get anywhere near your project.

Do this now, not tomorrow.

Speak soon,
Rob