/ Ai
System One Models: Jev, Kev, and Local-First Workflows with Laya
Use Jev and local Kev models for fast, typed decisions, and explore how Laya applies a similar separation of routing and deeper work to everyday notifications.
Archive.index
Blog
Browse recent writing, or follow the categories and tags that match the questions you care about.
More posts
/ Software
Composer and Packagist Are Hardening the PHP Supply Chain: What to Expect Next
The recent Packagist and Composer security update matters because it moves the PHP ecosystem away from best-effort trust and toward stronger release controls, malware filtering, and immutable versions.
/ Software
TrapDoor: The Cross-Ecosystem Crypto Stealer Hitting npm, PyPI, and crates.io
TrapDoor stood out because it was not tied to one package registry. It spread across npm, PyPI, and crates.io while targeting crypto developers, AI tooling, and developer workstations.
/ Software
Laravel-Lang and the Composer Tag-Rewrite Supply Chain Attack
The Laravel-Lang compromise showed how dangerous mutable tags and Composer autoload execution can become when attackers gain push access to a package namespace.
/ Software
Megalodon, Mass GitHub Actions Backdoors, and the Repo Supply Chain Problem
Megalodon showed that software supply chain attacks do not need a poisoned package when attackers can backdoor CI workflows across thousands of repositories instead.
/ Software
AntV and the Next Mini Shai-Hulud Wave Across the npm Ecosystem
The AntV wave showed how Mini Shai-Hulud evolved from a high-profile compromise into a mass npm credential-harvesting campaign across hundreds of packages.
/ Software
Poisoned Nx Console and the GitHub Internal Repository Breach
The poisoned Nx Console release and the resulting GitHub employee-device compromise showed how a developer extension can become a platform-level supply chain problem.
/ Software
Shai Hulud, TanStack, and the Return of Install-Time Supply Chain Malware
The Shai Hulud campaign showed how quickly modern package ecosystems can turn a compromised maintainer or CI path into broad install-time credential theft.
/ Software
LiteLLM and Telnyx: The PyPI Package Compromise Wave of March 2026
The LiteLLM and Telnyx incidents showed how stolen publishing credentials can turn trusted PyPI packages into fast-moving credential harvesters.
/ Software
Laravel Paper: Flat-File Eloquent for Modern Laravel
Laravel Paper lets you use Eloquent against Markdown and JSON files, keeping the familiar Laravel model workflow without reaching for a database first.
/ Ai
LLMFit: Lightweight Fine-Tuning for LLMs
Large models can be intimidating to customize: heavy frameworks, complex training loops, and expensive compute all get in the way.
/ Software
Superpowers: AI Coding Tools
Superpowers is an open-source collection of AI-assisted coding utilities that aim to streamline developer workflows.
/ Hardware
WithDiode: Build, Program, and Simulate Hardware in the Browser
WithDiode provides a fast path from idea to working circuit without wrestling with toolchains, bench wiring, or messy breadboards.
/ Ai
Voicebox: Local, Open-Source Voice Cloning with Qwen3-TTS
Voice synthesis has moved quickly from laboratory demos to production-grade tools. Voicebox aims to put cutting-edge voice cloning into a local-first desktop application.
/ Software
Laravel Introspect: Query Your Laravel Codebase Like a Database
Laravel Introspect turns parts of your Laravel application into something you can query with a fluent API: views, routes, classes, and Eloquent models.