Stop trying to make the agent trustworthy. Make the authority you hand it small enough that you do not have to. That is the only design that survives a model swap, a vendor change, or a jailbreak.

turn this setting on!

This should be mandatory curriculum for all ages m.youtube.com/watch?v=4b1K...

Amazon Has Axed Its New Stargate Series www.gateworld.net/news/2026/06... Amazon MGM Studios is not moving forward with Martin Gero's Stargate revival, which was to begin filming this fall.

One step closer to Q-Day xcancel.com/drakefjustin... quantumai.google/static/site-... Just in case anyone is not familiar, secp256k1 is also what secures your accounts on #ATProto

If you need a nudge to submit your proposal to NodeConfEU, let me tell you I just did and it was the shortest CFP form ever! 😉

Fuck Amazon (more than usual)

@tkdodo.eu Update on our conversation about secure defaults for projects - I'm starting work on a tool that would support setting up the repo to be safe from most supply-chain attacks per-packagemanager and without dependency on @lavamoat/allow-scripts because NPM will ship the allowlisting soon.

With NPM cli working on allowlisting install scripts, the right thing for LavaMoat to do is to deprecate @lavamoat/allow-scripts and instead build a tool to configure your project to be as strictly secure as possible with your package manager of choice. Post your ideas for naming the package 😉

This is absolutely nuts: hackers are hijacking high-profile Instagram accounts by simply asking Meta's AI chatbot to change the email on the account. Meta's AI does it, hacker gets password reset code, they're in. A staggering security issue www.404media.co/hackers-simp...

I was going to go to @cascadiajs.com as a fun throwback to catch up with old friends and make new ones / see how the community has changed. I haven’t been in years but I can’t make it as life has happened. Happy to donate my premium ticket to somebody that can make it & could use it.

🤣

check this box 👀

@jamiemagee.bsky.social sorry for mentioning it in a few places all at once, but it's going to be a big gap and it's not too late to address it yet: github.com/npm/cli/issu... (also, thanks for all the good work, I can't wait to deprecate `@lavamoat/allow-scripts`)

There's no reasons left. Go switch your package publishing to staged! And if you have many, consider: lavamoat.github.io/stageclicker/

If you want to understand the problem with googles new AI search let the founders of Google explain it.

While doing OIDC+staging setup I discovered repository names are case-sensitive on the NPM side and case-insensitive on github side 😍

well… we’ve crossed $90K USD and I’m starting to sweat a little bit

if we make it to $100K before the campaign ends today I will shave my beard off on a livestream build.awesome.me

📦 Set up staged publishing with approximately 1 click per package lavamoat.github.io/stageclicker/ Without sharing any of your permissions or exposing access to anything.

Blind tickets for NodeConf EU are *gone* — but regular tickets are live 🎟️ If you're planning to join us in Bologna, Italy for the best Node.js conference of the year, now's the time. CFP is open too — come speak! www.nodeconf.eu

Protestware for coding agents nesbitt.io/2026/05/28/p...

📦 Set up staged publishing with approximately 1 click per package lavamoat.github.io/stageclicker/ Without sharing any of your permissions or exposing access to anything.

Contrary to Anthropic's Mythos framing ("security used to be limited by how quickly we could find new vulnerabilities. Now it’s limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities"), security is actually limited by how quickly we can BUILD SAFE SYSTEMS

The aliens realize we're not actually conscious. Humans 'think' for 16-18 hours, then need to compact their context window for 6-8 hours where they hallucinate pretty much the whole time, then start over again. No true continuity of experience, just a series of fruit flies sharing a notebook

if you're interested in #npm staged publishes, check out how github.com/danielroe/uppt by @danielroe.dev does it. (also includes slim Release-Please-esque tooling)

We share a fragile collective delusion that the part of a platform that maintains security invariants is all written in C and that there’s a hard line where no load bearing code is running in a JavaScript virtual machine.

Took me a second to get it 😅

Apparently Amazon will not allow me to read the reviews of my own book

bsky.app/profile/mvsa... Short, typesafe example of this phenomenon. At this point, I'm thinking we need this to move forward even if it requires a "use types" directive or somesuch.

Some more validation for hardenedjs.org: Mythos pen-testing in Firefox was frequently thwarted by frozen prototypes in the host process. hacks.mozilla.org/2026/05/behi...

Do you know that using GitHub CLI (gh) may expose you to supply-chain attacks? It stores a long-lived GitHub token on your machine, which can be stolen by any malicious scripts. This is what happened in the recent Nx supply-chain compromise, which led to GitHub’s source code being leaked.

When I woke up this morning I didn't think I'd be spending a bunch of time today getting familiar with Catholic theology, but here we are. Notes on Pope Leo XIV's encyclical on AI. simonwillison.net/2026/May/25/...

I did not have the Pope quoting Gandalf about AI on my bingo card today 😳

A PhD student at Stanford noticed her classmates were asking Al to write their breakup texts. So she ran a study. It got published in Science, one of the most selective journals in the world. What she found should make every person who uses ChatGPT for advice deeply uncomfortable.

❌ I used a random number generator ✅ I wrote a synthetic heuristic script based on my known priors

Uber COO Andrew Macdonald said he's not seeing proportional productivity gains from increasing AI costs. https://bit.ly/4vdizCZ

I wonder how many people find "8 new emoji" compelling enough to download a 6GB OS Update.

As someone who has spent 26+ years working remote full time... I have opinions... It is both immensely rewarding/better than any alternative; and simultaneously immensely isolating and limiting at times.

You probably want to be using —ignore-pnpmfile in CI just say’n

Til downdetector has been acquired for 1.2b USD 😨

ECMAScript gratitude 😉 Huge thanks to @dmitrymakhnev.bsky.social for arranging to host this week's @tc39.es meeting in Amsterdam at @jetbrains.com 🙏 Dmitry was super thoughtful about all the details and an excellent communicator throughout.

One of the more quietly insidious effects of AI is that it makes you feel like an expert in areas you're not, which makes you devalue skills you know nothing about, until you're steering straight into disaster, believing so fully you've made an excellent choice that you write a blog post about it.

🚨 Active supply chain attack across npm, PyPI, and Crates.io. 34+ packages stealing crypto wallets, SSH keys, and cloud creds. The malware even plants poisoned .cursorrules and CLAUDE.md files to weaponize AI coding assistants. socket.dev/blog/trapdoo...

Note-takers are the unsung heroes of TC39. Without them, no progress could be made. It is right to give them thanks and praise. Here's to those who helped at this week's meeting! 🥳👏🙌 👇

💥 just released a github action: `uppt` it aims to be a very simple, secure release workflow for maintainers that adheres to best security practices ⚪ trusted, staged publishing on npmjs.com ⚪ github environment protection ⚪ generated release PR + changelog ⚪ automatic release + publish on merge ✨

if you dont know hexadecimal i feel bad for you son i got 9D9 problems thats 2521

@feross.bsky.social Since @socket.dev scans every package that gets published, it'd make sense to have a way to request scanning a staged package before approving it. Eliminates the worry of malware getting plugged in via CI. Changes nothing for Socket, but improves ecosystem /

On the tube

A little history lesson on the new @npmjs.bsky.social "Staged Publishing": github.com/npm/rfcs/pul... We had this mostly designed back in 2020 on the RFC calls. You cannot believe how happy I am to see this come to fruition. Great work team!