🏫 MY COURSES Sign-up for my FREE 3-Day C Course: https://lowlevel.academy 🧙♂️ HACK YOUR CAREER Wanna learn to hack? Join my new CTF platform: https://stacksmash.io ⌨️ KEYBOARD Like what you hear? Grab a Q5 at https://go.lowlevel.tv/keyboard 🔥COME HANG OUT Check out my other stuff: https://lowlevel.tv
ADVERTISEMENT
turns out Herb Sutter was right, C++ having no package manager is indeed a feature
2026 is officially the year of exploits
Every developer: *sees 5000+ directories in node_modules* "....this is fine"
And would C or C++ have prevented this exploit? <tongue in cheek> Yes they would, because they totally fail to have an easy to use centralized package manager/repository. Adding a dependency in C or C++ is a MAJOR decision, and often a PAIN IN THE ARSE. That.... is also a good thing. ;-)
I'd consider the idea that it might be a two-pronged issue: AI is making cyber attacks easier, but more importantly, people who used to work in the tech sector are getting laid off and people who got computer science degrees can't find jobs, meaning they either have no choice but to stoop to this level to provide for themselves, or they're doing it out of utter boredom and anger at the world. Just a thought.
Year of the Linux exploit.
its past time people start treating dependency creep as a vulnerability
I am scarred, the frequency of this freaking exploits are crazy day by day
Sec is DOOMED for at least the next six months. Coffee up.
Mr developer, another supply chain attack has hit the packages.
I've never been super opposed to package managers, but I've been feeling very vindicated in my utter contempt for the JS/frontend ecosystem lately.
Don’t worry management is on the job. They are gleefully firing as many devs as they can to replace with AI. Any senior knowledgeable ones left have all their time taken up reviewing AI slop code. That is a perfect defense against this new severe threat environment.
Abolish all computers! All hail the abacus!
Cargo is only one commit away from compromise too. Things can get hidden easily at scale. I'm really cautious about picking up any dependency now.
Escaping the virtual machine is the biggest thing I've ever heard so far! This means it can affect the host machine
What i did was convert my entire 50,000 line codebase to php. Npm is off the rocker.and the inmates are running the asylum.
haha yeah. live @ /LowLevelTV eventually
Neatly Packaged Malware.
The worms shall continue until dependency trees get trimmed. Given this thing will keep happening, at least we should try to be happy about it.
The Jia TanStack