"It's very bloaty, and there's a lot of copy-paste, and there's awkward abstractions that are brittle, and it works, but it's just really gross" - Andrej Karpathy I couldn't have summarized the past five years any better.

Just released AgentScan action v1.6.0, now including support for the workflow on issues as well. Thank you @nodeland.dev github.com/marketplace/...

Today marks about 3 months since patient zero, Kai Gritun, was publicly spotted spamming OSS projects using AI. What a time to be alive. Happy Clankers' Day!

Just added support for external lists of flagged accounts on agentscan.tools Thanks @heyandras.dev for this awesome list!

Whenever I get a question that begins with "Did GitHub just break ..." or "Did NPM accidentally ...", my usual response these days is yes unless told otherwise.

We made a fake repo with fake bounties, and the bots are applying fake PRs, so we know who is fake, and we can ban them from the Coolify repo. IQ over 1000

After a few days of data collection, a new page on AgentScan was just published, featuring a daily snapshot of the overall ecosystem health. Your daily dose of clankers. Big thanks to that mythological creature that is @graphieros.npmx.social ❤️🙏 agentscan.tools/health

It should be mandatory to approve a PR using a GIF.

Big thanks to the one and only @graphieros.npmx.social for these super cool graphs showing accounts activity bursts on agentscan.netlify.app

In the era of basically weekly supply-chain attacks on npm packages, lots of developers not even know what the AI is installing for them. That freaks me out more than the supply-chain attack itself.

AgentScan's community-maintained automations/spammers list has an RSS feed available if you find it useful. agentscan.netlify.app/feed.xml

You can now have inline account analysis directly on GitHub. The extension update is pending approval, which may take time. In the meantime, to use it and provide feedback, clone the repository and install the extension manually 🙏 github.com/MatteoGabrie...

I think I cracked it. There's a clear link between how much slop you create in OSS projects and the length of your GitHub profile's README page. It's quite a striking correlation, and I'm not even joking.

I'm working on a little something something. I might be able to get the account analysis directly in issues and PRs, so it's easier to quickly glance at automated or flagged accounts.

We are in a dark period where PRs from real contributors might get auto-closed because maintainers no longer trust contributions to be genuine. Go play some COD if you don't care about the community, and leave open source to people who actually love it.

We might have hit peak-2026 with just one PR.

[developer submits a slop PR] me: "You’re in a desert, walking across the sand, you see a tortoise crawling toward you. You flip it onto its back, its belly exposed in the hot sun, legs struggling to turn over, but it can't without help. But you’re not helping."

Happy that the multi-select feature is finally live on @npmx.dev along with lots of new features, bug fixes, and other updates. github.com/npmx-dev/npm...

Alright, the first version of the GitHub action is published. If you'd like to try it out, please share some feedback. Hopefully, this will help a little with guarding PRs in these dark days of automation craziness. github.com/marketplace/...

If you're looking for some inspiration for your website, look no further. I'm having a blast going around deadsimplesites.com

Just added a `detect-agent` workflow to Clack to tag fully automated PRs. Based on @matteogabriele.bsky.social's agentscan.netlify.app project which surfaces suspicious patterns from account activity. No auto-close for now, but it's an important signal to have. github.com/bombshell-de...

we're all here 🤍

Ok, the Chrome extension has been approved and is open source. It's a first iteration, and I hope to make it more insightful in the future. For now, a link will be displayed on the account page so you can go directly to AgentScan's profile page. 🤖🚫 chromewebstore.google.com/detail/npnlp...

One key takeaway from the recent Vue conference is the importance of human interactions, especially in open source. Contribute to open source, value human connections, have fun, and please leave automations at the door.

Hear me out: what if we go back to making cool apps with great features, and we don't bother telling each other whether they use AI? What if nobody needs to care what powers what?

AI agents flooding PRs should be opt-in, not something users struggle to disable.

Just submitted this small Chrome Extension to the store!

Fun fact: I based the scoring system on how to determine whether GitHub events are likely automated, using @danielroe.dev contribution patterns. If you code more than him, you must be an AI agent.

It's clear that most companies aren't writing their own job posts: they all sound identical, they all lead the market, and when I read them, I never really understand what the company actually does. It's just 300+ words of emptiness.

Doors are open! If you find any AI agents in the wild, take a moment to add a new issue following the template and let's flag these pesky AI accounts.

npmx is now in alpha: this is our story, as told by our team and friends

Reconsidering the atproto integration in AgentScan. Openness is appealing, but it is also a problem: spam, throwaway accounts, polluted datasets. Leaning towards a curated queryable JSON in the repo instead. Simple, auditable, no infrastructure needed.

In the past 7 days, ClaudeBot has been paying me multiple visits. A website built to detect AI agents is getting hammered by... AI agents. Time to poison the well. 🧪

Working on a community-based flagging system for automated accounts through atproto. Main concern: false positives caused by bad actors contaminating the dataset. The goal is to identify genuine automation without mistakenly flagging legitimate irregular activities. Any thoughts?

Since January, I've been job-hunting and, unexpectedly, have started doing open source full-time. I've spent some of this time contributing to @npmx.dev and other projects with some of the kindest, most talented developers I've met. It won't last forever, but I'm loving every second of it 🙏

if you like my OSS work, please do consider sponsoring 💙 these sponsorships help a lot and are much of why I'm able to carve out dedicated time for open source. i'd love to be able to do more to help the community

It looks like it was just a matter of time before AI agents began contributing to open-source projects. Since there's no way to flag them yet, I built an app that flags bot-like behavior using the GitHub API and an opinionated scoring system. agentscan.netlify.app?user=matteog...

We have a unique opportunity with npmx. We're building something very special together. I want to give myself the chance to focus on helping steward the project. I'm going to be working as an independent open source developer this year. Support my work and help me focus on npmx long-term 🙏

we're 100 contributors in 10 days in the repo.npmx.dev 🙌 join us! let's build together the browser for the npm registry we deserve!

It feels like the entire internet is working at @npmx.dev 👀

The better npm site got warnings on packages that should be avoided yesterday. Big thanks to the @e18e.dev community for making that easy!

npmx don't tell anyone 🤫

Are you coding too much? Take a break! gifrequest.com

UTM tags in shared links are the silent privacy killer.

Proud to announce TechConf.Directory, a directory of tech conferences around the globe. I've found it quite difficult to find conferences. That is true no more! I've made all the data fully open and available via a fully queryable API as well. techconf.directory #Conferences #Tech #Programming

I'm experimenting with the SpeechSynthesisUtterance API and wondering who decided the world needed built-in browser text-to-speech with options like an Italian grandma's voice. It's hilarious! Thank you!

This is the way.

Saying that a product "uses AI" is irrelevant on its own. It’s like advertising that an application is "flexbox-first". As a user, I don't care about what you use under the hood. What matters is the value you deliver and the problems you solve for the end user.

There's something about HTML attribute types that I find very realistic. The selected attribute of the select option is... Boolean-ish! It's like whatever. Relax!