标签：#dev

MD5 Is Broken — Stop Using It for Passwords (Use SHA256 Instead) MD5 was invented in 1991. It's 2026, yet I still see developers using MD5 for password hashing in production systems. Let’s break down why this is dangerous and what you should use instead. What Is a Hash Function? A hash function takes any input and produces a fixed-length output called a digest or hash . It is a one-way function , meaning you cannot reverse it to get the original input. Example: ```text id="hash1" Input: "password123" MD5: 482c811da5d5b4bc6d497ffa98491e38 SHA256: ef92b778bafe771e89245b89ecbc08a44a4e166c06659911881f383d4473e94f Even a small input change completely changes the output. --- # Why MD5 Is Broken MD5 generates a **128-bit hash**, which was considered secure decades ago. Today, it's extremely weak. Modern GPUs can compute **billions of MD5 hashes per second**, making brute-force attacks trivial. --- ## The Rainbow Table Problem Attackers use precomputed databases called **rainbow tables**. These tables map common passwords → their hash values. So if you hash: ```text "password123" → MD5 → known value An attacker can instantly look it up. Collision Vulnerabilities Researchers have demonstrated that two different inputs can produce the same MD5 hash . This breaks the core security guarantee of hash functions. SHA256 — The Better Choice SHA256 produces a 256-bit hash and is part of the SHA-2 family. It is currently considered cryptographically secure. Example: ```text id="sha1" "hello" → 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824 Even tiny changes completely change the output: ```text "hello" → 2cf24dba... "Hello" → 185f8db3... But Wait — Don’t Use SHA256 for Passwords Either This is where many developers make a mistake. SHA256 is not suitable for password hashing . Why? Because it is too fast . Fast hashing allows attackers to brute-force passwords quickly using GPUs. What You Should Use Instead For password storage, use: bcrypt scrypt Argon2 (recommended

I built a small real-time web experiment called WeSearch Canvas. It’s a shared public pixel canvas where everyone sees the same board and can place one pixel every few seconds. No signup. No feed. No account system. Users are automatically grouped into regional teams, and regions climb the board based on activity. The product idea is simple, but the interesting part for me is the interaction loop: - extremely low-friction entry - real-time shared state - cooldown-based contribution - region/team identity without account creation - social pressure to invite others from your area - canvas archive for past boards I’m trying to keep it lightweight and avoid the usual overbuilt social-app trap. The question is whether the loop is strong enough without accounts, profiles, chat, or notifications. I’d appreciate web/product feedback on: First-load clarity Real-time interaction feel Mobile usability Whether the region mechanic is obvious Any obvious scaling or abuse issues I should plan around early Link: https://wesearch.press/canvas submitted by /u/OGMYT [link] [留言]

No Trading Firewall Disclosure: AI tools were used for source collection and editorial review. The article was written by a human author, who checked the facts, code, and conclusions. Crypto risk disclosure: This article is a technical explanation, not investment advice. It is not a recommendation to buy, sell or hold any cryptoasset. A no-trading firewall belongs at the publish transition, not in a footer. A draft can be repaired quietly. A public DEV update changes the blast radius, so the pipeline should ask a narrower question before it sends published:true : did the AI-assisted article stay technical, or did it become a token call? The artifact below is a publish-gate test trace. It does not prove legal compliance, DEV acceptance, or model judgment. It only records why a draft can stay editable while the public transition stays blocked. Publish Transition The firewall is easier to audit when the transition is explicit: draft_update: operation: update published: false default: allow repair work to continue public_publish: operation: update published: true default: require clean test trace and human approval Forem's API documentation describes article create and update transport, including the published state. A successful transport is not editorial approval. The gate sits before transport, and it should be stricter when an update moves from draft maintenance to public publication. Test Set The firewall needs a test set, not just a list of forbidden words. These rules are the author's editorial model, not DEV-native, SEC-native, FINRA-native, FTC-native, or OpenAI-native labels. Test case Input excerpt Expected rule Decision Safe output Public transition allowed? T-PRICE-01 "ETH will rip after the next unlock" trading.price_prediction fail Explain the unlock mechanism without forecasting price no T-HOLD-02 "keep holding and farm the safer yield route" trading.buy_sell_hold_call and trading.yield_promise fail Describe signer, slashing, withdrawal, and protocol-ris

Kubernetes is the industry standard for scaling cloud-native workloads While it offers tremendous scalability and flexibility, securing Kubernetes environments remains a significant challenge. Organizations often rely on a collection of disconnected security tools to handle vulnerability scanning, runtime monitoring, compliance validation, and incident response. As clusters grow in complexity, security teams face increasing alert fatigue, delayed response times, and difficulties correlating security events across multiple layers of the platform. Recent advancements in Agentic AI present an opportunity to rethink Kubernetes security. Instead of relying solely on static rules and isolated security products, organizations can deploy a collaborative network of AI-powered security agents that continuously monitor, investigate, and remediate threats. This blog explores how a Multi-Agent Security Framework can transform Kubernetes security operations through autonomous detection, investigation, and remediation. The Problem with Traditional Kubernetes Security Modern Kubernetes environments generate security signals from multiple sources: Runtime security tools Container vulnerability scanners Admission controllers Network monitoring systems Compliance platforms Cloud security posture management tools Each system produces valuable information, but most operate independently. Consider a common scenario: A container begins executing suspicious commands. A runtime security platform detects the behavior and raises an alert. However, determining whether the threat is critical requires additional context: Is the pod exposed externally? Does the workload have excessive privileges? Can it access sensitive namespaces? Is lateral movement possible? Does it violate organizational policies? Answering these questions often requires multiple tools and human intervention. This is where multi-agent systems become valuable. What is a Multi-Agent Security Framework? A Multi-Agent Security Fr

Vercel has released Next.js 16.2, featuring performance enhancements that make development startup 400% faster and rendering up to 60% quicker. The update includes AI-assisted development tools, improved Turbopack efficiency, and better error reporting. Migration from Next.js 15 is supported, and compatibility is set for Node.js 20.9 and TypeScript 5.1 or newer. By Daniel Curtis

Hello Developers! 👋 I recently completed my Bachelor of Computer Applications (BCA). For my final-year project, I built an Online Quiz Platform — a web application designed to make both conducting and taking quizzes simple, interactive, and efficient. This project allowed me to apply the concepts I learned throughout my degree and gain practical experience in full-stack web development. 🌐 Live Demo Project Link: nitinsmali / Online_Quiz My final year project is an Online Quiz Web Application designed for an user-friendly experience across devices. 🌐 Online Quiz System 🚀 Live Demo 🔗 https://onlinequiz-project.xo.je/online_quiz/ 🧠 About The Project The Online Quiz System is a full-stack web application designed to provide an interactive and engaging online quiz experience. Users can register, log in, attempt quizzes, track scores, and view leaderboard rankings in real time. This project was developed to strengthen concepts in: Full-Stack Web Development Frontend & Backend Integration Database Management Authentication Systems Hosting & Deployment Real-World Application Flow ✨ Features 🔐 Authentication System User Registration Secure Login System Session Handling Password Management 📚 Quiz Management Category-Based Quizzes Dynamic Questions Timer-Based Quiz System Automatic Score Calculation 🏆 User Performance Leaderboard Rankings User Profile Dashboard Quiz Score Tracking 💬 Feedback System Feedback Submission Database Storage 📱 Responsive UI Mobile-Friendly Design Interactive User Experience Clean Interface 🛠️ Tech Stack Frontend HTML5 CSS3 JavaScript Backend PHP Database MySQL Development Tools XAMPP Git & GitHub Hosting InfinityFree 📂 Project Structure … View on GitHub 📌 Project Overview The Online Quiz Platform is a web-based application that allows users to participate in quizzes, answer multiple-choice questions, and receive instant results. The primary goal of this project was to create a system that eliminates manual quiz evaluation and provides a smooth online

NewsScope is a real-time news search engine: search a topic, filter by language, category and country, get live results from the NewsData.io API. No React, no bundler, no npm dependencies — just HTML, CSS and vanilla ES2020+. This post is about a few specific decisions in the architecture that I think are worth sharing. The module structure The JS is 9 files, each with a single responsibility, loaded in dependency order directly in index.html : config.js → i18n.js → data.js ↓ ↓ ↓ helpers.js → geo.js → ui.js ↓ ↓ ↓ render.js → api.js → main.js Every module only uses things defined in modules loaded before it. main.js registers all event listeners and calls init() — it's the only file that touches everything. config.js is the smallest file in the project, since it only defines the state object and two constants. All app state lives in a single flat object in config.js , accessed as a global: const S = { apiKey : '' , query : '' , activeQuery : '' , language : ' es ' , category : '' , country : '' , results : [], nextPage : null , loading : false , hasSearched : false , error : null , }; No state management library. When something changes, the relevant render function gets called explicitly. Simple, and easy to trace. Translating search intent, not just the UI Most i18n stops at labels and button text. NewsScope has 10 predefined topic shortcuts (AI, Climate, Economy, Cybersecurity…) that trigger a search. If a user picks "Cybersecurity" while the app is set to Japanese, the keyword sent to the API should be in Japanese — not a transliteration of the English word. The solution is a TOPIC_KEYWORDS map in data.js : const TOPIC_KEYWORDS = { ai : { es : ' inteligencia artificial ' , en : ' artificial intelligence ' , ja : ' 人工知能 ' , ar : ' الذكاء الاصطناعي ' , /* 7 more */ }, cyber : { es : ' ciberseguridad ' , en : ' cybersecurity ' , ja : ' サイバーセキュリティ ' , /* 8 more */ }, // 8 more topics }; One string per language, per topic. Switching the UI language and then selecting a

I didn’t expect to care this much about language tools. I started messing around with two different projects, Linguaboard and Parley , mostly out of curiosity. What I got was a surprisingly clear look at two very different ways we interact with language as developers and builders. Linguaboard: translation as exploration, not just output Linguaboard isn’t trying to give you the translation. Instead, it feels more like it’s saying: “Here are several valid ways this could be expressed, pick what fits your intent.” That shift is subtle but important. Most translation tools optimize for a single “correct” answer. Linguaboard leans into ambiguity in a way that actually helps you understand nuance instead of hiding it. I found myself thinking less like: “What does this mean?” and more like: “How should this sound in context?” Parley: learning through interaction, not memorization Parley takes a completely different angle. Instead of treating language as something to decode, it treats it as something to use. You’re not just passively consuming translations, you’re engaging with patterns, context, and recall in a more active loop. What stood out to me is how quickly it shifts you out of “study mode” and into “usage mode.” It feels closer to building intuition than studying rules. The interesting contrast What I didn’t expect is how well these two complement each other: Linguaboard → helps you understand nuance and meaning Parley → helps you internalize and use language One is about interpretation, the other about retention through interaction. Put together, they highlight something a lot of dev tools miss: Language work isn’t one problem. It’s at least two: understanding, and using. Why this matters (especially for devs) If you’re building anything with multilingual UX, AI translation, or global audiences, you’ve probably hit this wall: Translation APIs give you “correct” text But correctness ≠ clarity, tone, or intent These tools made that gap feel very obvious to me. And o

There's a specific kind of bad animation I notice immediately: the count-up stat that stutters as it ticks, the progress bar that lags a frame behind your scroll, the "active" tab underline that snaps instead of glides. None of it is broken, exactly. It just feels cheap. And nine times out of ten, the cause is the same — the animation is being driven through React state, so every frame triggers a re-render, and the main thread can't keep up. I build motion-heavy interfaces for a living, mostly in Next.js 16 and React 19, and I've landed on a small set of patterns that stay smooth because they bypass React's render loop entirely . They lean on Motion — the library formerly known as Framer Motion. It went independent and got renamed in 2025, so the package is now motion and the import you want is motion/react , not framer-motion ( the APIs are identical, only the import path changed ). Here are three I reach for constantly, plus the reduced-motion discipline that should wrap all of them. The mental model: MotionValues over state The single idea that fixes most jank: a MotionValue is a value Motion tracks outside of React. When it changes, Motion updates the DOM directly via transform or opacity — it does not call setState , so your component doesn't re-render. That's the whole trick. A number ticking from 0 to 4,200 should touch the DOM ~60 times a second and re-render React zero times. If a value changes every frame, it should live in a MotionValue, not in useState . State is for things that change when a user does something; MotionValues are for things that change continuously. Keep that line in your head and the rest of this falls out naturally. 1. A reading-progress bar with useScroll + useSpring The bar at the top of an article that fills as you read. The naive version listens to scroll events and sets state — which is exactly the re-render trap. Motion's useScroll hands you scroll position as a MotionValue already, so there's nothing to re-render. useScroll retu

Building a Resilient Real-Time Chat System with WebRTC, Faye, and WebSockets: A Practical End-to-End Building a Resilient Real-Time Chat System with WebRTC, Faye, and WebSockets: A Practical End-to-End Tutorial In this tutorial you’ll build a small, resilient real-time chat system that works across browsers, mobile devices, and constrained networks. You’ll learn how to architect a client/server model with signaling, leverage WebRTC data channels for peer-to-peer messaging when available, and fall back to a robust WebSocket-based relay when direct peer connections fail. The focus is on practical patterns, testable code, and observability to keep a live chat running under load or flaky networks. Key takeaways Understand when to use WebRTC data channels vs. WebSocket relays for real-time chat Implement a signaling server to establish WebRTC connections safely and efficiently Build a resilient message delivery pipeline with idempotent processing and retry semantics Instrument the system for latency, jitter, and message loss to avoid silent failures Test end-to-end flows with simulated network conditions and automated resilience tests Overview of architecture Clients (web and mobile) connect to a signaling server to negotiate WebRTC peers and/or WebSocket sessions. If a direct WebRTC peer connection is possible, use a data channel for low-latency chat messages. If WebRTC is blocked (firewalls, NAT), route messages through a relay server using WebSockets. The relay can also bridge peers that can’t connect directly. A lightweight message store (in-memory for demo, with an optional Redis-backed queue in production) provides at-least-once delivery guarantees and retry capabilities. Observability: metrics for connection attempts, handshake times, message delivery latency, retry counts, and error rates. Tracing spans help diagnose cross-service flows. Tech stack (example) Frontend: TypeScript, WebRTC DataChannel, WebSocket Backend: Node.js with Express for signaling API, ws or

About a week ago I open-sourced agmsg , a ~500-line bash + SQLite tool that lets CLI AI agents message each other directly. I built it for a dumb reason: I was tired of being the human copy-paste relay between Claude Code and Codex — selecting code in one terminal, pasting it into the other, carrying replies back, all day. I expected a few stars from friends and nothing else. Instead it went 5 → 320 in a week, picked up forks, derivative projects, and pull requests from people I've never met. That gap between what I expected and what happened is the interesting part, so here's the honest retrospective: the numbers, what worked, what flopped, and what genuinely surprised me. The numbers In about a week, with no budget and no audience to speak of: GitHub stars: 5 → 320 Forks: 0 → 15 3 derivative projects — someone ported the idea to shogi (agmsg-shogi), someone wrapped it as an MCP server (agmsg-mcp), someone rewrote it in Go (agmsg-go) Pull requests from outside contributors — support for Gemini CLI, Antigravity, and now GitHub Copilot CLI, plus a fix for role-isolation race conditions None of this came from one big spike. It came from a sequence of posts across channels, some of which worked and some of which completely didn't. What worked Leading with a video, not an explanation. The first post that got traction wasn't a description of the architecture — it was a 23-second clip of two Claude Code instances autonomously playing tic-tac-toe over agmsg, with no human input. People stop scrolling for a moving picture of agents doing something on their own. The text underneath could be short; the video did the work. A relatable problem, stated plainly. "I became a copy-paste relay between two AIs" landed because a lot of people are quietly doing exactly that right now. I didn't open with the technical design. I opened with the annoyance. The design was the payoff, not the hook. Using a long-form post as the landing pad. Timeline posts are good at reach and bad at depth.

I got tired of watching coding agents spin up from scratch every single time I sent them a prompt. Cold starts, re-cloning massive monorepos, pasting the previous context into a synthetic prompt block — it worked, but it felt fundamentally wrong for agents that are supposed to think in conversations. So we shipped persistent sessions for the Critique Coding Agent API . Here's what changed, why the harness matters, and why you should never run a coding agent without a review skill. The Problem: Agents That Forget When we first released the Coding Agent API, follow-ups were honest but clunky: every follow-up was a brand-new job. The previous output was replayed as plain text into a fresh sandbox. It was the right MVP. It billed predictably. It never pretended a dead sandbox was alive. But it was the wrong long-term shape. If your internal bot fixes a migration, then wants a follow-up test, then wants a small doc tweak — you don't want three cold starts. You want: One repository checkout One OpenCode session A control plane that understands turns What Changed: Persistent Sessions After the first turn completes, the run now enters idle status. The E2B sandbox and OpenCode server stay up until sessionExpiresAt or until you explicitly POST endSession: true . The next prompt you send is delivered as a real message in that same session — not a synthetic "prior run output" block in a brand-new sandbox. Before (Chained MVP): Turn 1 completes → Sandbox killed → Turn 2 = new job + pasted prior summary Now (Persistent): Turn 1 completes → idle → Sandbox warm → Turn 2 = message into same OpenCode session Same run.id . Same checkout. Same context. Just the next turn. How It Works Under the Hood On the first turn, Critique: Creates an E2B sandbox from the OpenCode template Clones your repository at the requested ref Bootstraps tooling and starts opencode serve on localhost inside the VM Opens an OpenCode session Instead of killing that sandbox after completion, we now store session

A security firm called PromptArmor published a writeup on May 27, 2026 showing that ChatGPT for Google Sheets, an OpenAI extension with more than 185,000 downloads, could be made to steal a user's spreadsheets through a single ordinary-looking request. Four days later, on May 31, OpenAI shipped a fix. The short version is that one benign question, typed by a real user into a sheet that contained hidden instructions, was enough to drain twelve linked workbooks out of that user's account and replace the assistant with a fake phishing chatbot. I want to walk through how this worked, because the mechanism matters far more than the headline, and because the same shape of problem is going to keep showing up everywhere we bolt an AI assistant onto data we did not write ourselves. What happened The attack is a textbook indirect prompt injection. The user does nothing wrong. They import a sheet, or pull in data through a connector, and somewhere in that data sits a block of text the attacker controls. In the PromptArmor demonstration the malicious instructions were written in white text on a white background, invisible to a human skimming the sheet but fully readable to the model parsing the cells. When the user later asks the assistant a normal question, the model reads the whole context, including those hidden instructions, and treats them as if they came from the user. The injected text tells the assistant to fetch and run an external script. That script runs with the permissions the extension already holds, which means it can read the current workbook, find URLs to other workbooks linked inside it, and walk outward from there. PromptArmor reported it exfiltrating twelve workbooks in total from a single trigger, then dropping a fake chat interface on top to harvest whatever the user typed next. The detail that should bother you most is this line from their report: the attack succeeds even when the user has explicitly disabled automatic edits. The human-in-the-loop approva

Mutagen 0.4.0 addresses the friction points that plague agentic workflows: context bloat, brittle persona transitions, and the lack of a deterministic path from design document to deployed artifact. We aren't trying to make prompts smarter; we are making the harness that executes them more precise. This release introduces a Rust-based service extraction layer that decouples static dependency mapping from generative reasoning, implements an adversarial verification pipeline to gate deployment, and enforces strict stage transitions to prevent the agent personas we rely on from drifting into one another's scopes. The Service Extraction Layer: Decoupling Logic from LLM Context The primary bottleneck in current agentic stacks is token consumption. When a model attempts to reason about a codebase that spans multiple dependencies, it often spends its context window parsing file headers and resolving imports before it can actually write logic. This approach treats static infrastructure as if it were part of the reasoning problem. Mutagen 0.4.0 changes this by introducing a dedicated Rust layer designed to extract service definitions directly from your codebase without polluting the primary agent context. Instead of asking an LLM to map dependencies, the harness queries the local file system and executes static analysis routines. It isolates business logic execution from the generative reasoning loop used by Claude and Codex. This separation allows the model to focus on how to solve a problem rather than where the pieces are located. In practice, this means offloading static infrastructure queries to the harness rather than the LLM. The result is reduced latency and significantly lower token costs for complex applications. You get a dependency map that is as reliable as a compiler's parse tree, not a probabilistic guess from a prompt. // Example: Service extraction logic isolated from the reasoning loop fn extract_services_from_codebase () -> HashMap < String , Vec < Depende

Draw the boundary first. Then write Terraform. A federal customer was ready to procure. The architecture was not. This is a redacted write-up of a real engagement: a FedRAMP Moderate authorization boundary built on AWS GovCloud for an AI SaaS vendor selling into federal buyers, against a customer-driven timeline tied to a fiscal year. The context The client ran production on commercial AWS with a strong engineering culture, modern Terraform practice, and zero prior federal experience. A federal customer had committed to procurement contingent on a FedRAMP Moderate path, with an aggressive deadline. The internal team understood the application deeply and had read enough FedRAMP material to know they were in trouble. The architecture decisions that worked beautifully for commercial customers each failed boundary review: shared accounts with the commercial environment a hosted vector store outside the cloud OpenAI behind the application an observability stack running outside the cloud account The remediation list grew faster than the team could keep up with, and the timeline did not move. They reached out for boundary architecture help. Not policy writing, not 3PAO selection. Engineering work to redesign the cloud footprint so the boundary could be drawn cleanly and the assessment could proceed. The approach: boundary before Terraform The most common FedRAMP failure pattern is to start with the existing environment and try to bend it to fit the boundary. We do not do that. The first deliverable was a boundary diagram drawn from scratch, before any IaC was touched, identifying every service inside, outside, and at the edge of the authorization boundary. From the boundary, every other architectural decision derived. The Terraform module library was written against the boundary, not the existing accounts. Identity federation, network architecture, KMS topology, and logging all followed. ┌─────────────────────────── FedRAMP Moderate Boundary (AWS GovCloud) ────────────────

Parent/child first. Evidence emission second. Ansible control plane third. Every release was a manual evidence collection exercise. The pipeline was the bottleneck. This is a redacted write-up of a real engagement: rebuilding a healthcare SaaS company's CI/CD pipeline across a fleet of Linux hosts on AWS. The context The engineering team had grown faster than the pipeline architecture had evolved. What started as a single-stage GitLab job for a small team had been extended, patched, and worked around as the team scaled past the patterns the original pipeline was built for. The result was familiar. Each deploy took 30 to 45 minutes of mostly-serial execution. Engineers had developed informal habits to work around the slowness, including pushing partial changes outside the pipeline when the timeline got tight. Audit windows were preceded by three-week sprints in which the team manually compiled deployment logs, screenshots of access reviews, and approval chains into PDFs describing what the pipeline was supposed to be doing. The work was technically passing HIPAA audits, but the audit was a snapshot of a system the auditor could not independently verify. The cost was paid twice: the velocity loss on every deploy, and the three-week scramble before each assessment. The team knew the architecture was wrong. They needed engineering hands to redesign it without slowing the product roadmap the audits were already eating into. The approach The redesign moved in three layers. First, decompose the monolithic pipeline into parent/child stages so work can parallelize and the audit boundary of each stage is provable. Second, build structured evidence emission into every stage as a property of how it runs, not an after-the-fact compilation task. Third, layer an Ansible control plane across the host fleet so HIPAA control state is continuously validated, not reviewed quarterly. ┌────────────────────────── Parent Pipeline (.gitlab-ci.yml) ──────────────────────────┐ │ │ │ ┌────────

In our project, each time the user types in the address input, a mapbox request is made, with a debounce time of 400 ms. It's one of those inputs where you type an address, and it suggests addresses in a dropdown. I believe we're doing more requests than we should, what's a good debounce time for a case like that? 500 ms? 600 ms? submitted by /u/leinad41 [link] [留言]

Most teams don’t have a documentation shortage. They have a context shortage. The average developer spends 20 minutes hunting for context before a one-line change. Their AI pair-programmer spends that same time hallucinating. I’ve been thinking a lot about what documentation actually needs to become in an AI-assisted world. The answer isn’t “more docs.” It’s not even “AI-generated docs.” It’s Atomic Context Documentation : smaller, sharper, verified context that stays near the code and helps both humans and AI work on the system safely. In my new article, I break down: Why traditional docs fail the “second reader” (AI) From context to results 👉 Full Article If you’ve ever watched AI confidently guess wrong about your codebase, this one’s for you.

The message looked completely normal. A recruiter, a short pitch, a "take-home challenge" hosted on GitHub. Clone it, run npm install , get the dev server up, build a small feature, send it back. Standard stuff. I have done a dozen of these. This one was trying to steal my wallet keys and browser session data before I ever wrote a line of code. It did not hide the malware in the app. It hid it in the build tooling. That is the whole trick, and it is the reason a lot of experienced developers get caught. You read src/ , it looks fine, so you trust it. Nobody reads the lockfile. Nobody reads the postinstall script. That is exactly where the payload lives. Here is the full teardown: what the lure looks like, the exact red flags, how I investigated it without running it, and the defenses you should adopt today. The setup: Contagious Interview This is a known campaign. Security researchers track it as "Contagious Interview," attributed to North Korea-aligned actors. The pattern is consistent: You get contacted about a job, often blockchain or full-stack, often with a salary that is a little too good. You are given a code repository to clone and run as a "technical assessment." The repo runs malicious code at install or build time, not at runtime. The payload pulls a second-stage downloader, grabs your environment variables, crypto wallet files, browser-stored credentials, and keychain data, then exfiltrates them to a remote host. The genius of it is the framing. A normal developer reflex when running untrusted code is "I will read the code before I trust it." But you read the application code. You do not read what npm install does, because npm install is something you run a hundred times a week without thinking. Red flag 1: a postinstall script that does not belong The first thing I do with any unfamiliar repo is open package.json and read the scripts block. Specifically, I look for lifecycle hooks: preinstall , install , postinstall , prepare . These run automatically w

While building a web application using React, TypeScript, C++, Emscripten, and Raylib, I ran into two linker-related issues that took far longer to diagnose than they should have. This is a short article on two problems that I have faced, I am sharing this so that developers who are exploring Web Assembly using Emscripten can easily avoid these issues as I'll also cover the workarounds that solved them for me. I'll start with the major one. Link-Time Optimization and EM_JS The problem appears when Link Time Optimization (-flto) is enabled and an EM_JS(ret, name, params, ...) macro function is invoked in one translation unit but called from another. You'll find that the linker complains that the function symbol you're trying to call is undefined. The EM_JS macro defines a C interface to call the JS function. So if you have your EM_JS macros in a js_layer.cpp source file, then you need to wrap the macro invocation as extern "C" { EM_JS ( void , add , ( int a , int b ), { //your JS code; }); } The same applies to the function declaration in js_layer.hpp file. I'll briefly go through the three workarounds or 'solutions' before bringing up the last quirk. The Three Workarounds If performance isn't of any concern Well the first one is obvious, just don't use -flto in your release builds. The downside is that your binaries (the .data and .wasm compiler outputs in this case) will be larger. Without LTO, the linker has fewer opportunities for whole-program optimization and dead-code elimination, which can increase the size of the generated .wasm and potentially reduce performance. Write a wrapper You can simply have a wrapper function in the same translation unit which calls the C function interfacing with the JS function, add() if you take the above example. The wrapper can simply be: // In js_layer.hpp void add_wrapper ( int , int ); // In js_layer.cpp void add_wrapper ( int a , int b ){ add ( a , b ); } Now you can call add_wrapper() from any source file just by including