When Your Editor Becomes the Worm

The attacker designed this as a self-spreading vector that targets Claude Code and VS Code users.

• 404 malicious versions published across 170+ npm packages and 2 PyPI packages in a five-hour window on May 11
• Entire TanStack router scope, all three Mistral AI SDKs, the @uipath scope (65 packages), OpenSearch's official npm client, and Guardrails AI were all compromised
• Two trigger styles: Mistral packages used a preinstall hook downloading Bun then a payload; TanStack used an optionalDependency pointing at a malicious commit in the real tanstack/router GitHub repo
• Payload drops .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json into victim repos and pushes them via GitHub's createCommitOnBranch GraphQL mutation — Claude Code and VS Code become re-infection vectors
• Exfiltration runs over the Session onion-routed messenger network with no fixed C2 domain to seize
• Credential providers target AWS IAM (via 169.254.169.254), HashiCorp Vault on localhost:8200, ghp_/gho_/ghs_/npm_ tokens, and GitHub Actions OIDC

humans increasingly get pushed out not because the work doesn't need them, but because the interface has no room for them.

• First research-preview model, TML-Interaction-Small, trained from scratch around a multi-stream micro-turn design rather than turn-based prompts
• 200ms input chunks interleave with 200ms output chunks, so the model can listen, speak, watch, and call tools concurrently
• Pairs a real-time interaction model with an asynchronous background model for sustained reasoning and tool use; the interaction model stays present while the heavy work runs
• Encoder-free early fusion: audio as dMel, video as 40x40 hMLP patches, all co-trained with the transformer
• Beats GPT-realtime-2.0 (minimal) and Gemini-3.1-flash-live on FD-bench v1.5 and Audio MultiChallenge at 0.40s turn-taking latency
• Introduces new benchmarks TimeSpeak and CueSpeak for proactive speech (e.g. 'remind me to breathe every 4 seconds', 'correct mispronunciations as you hear them')

we talk about programming like it is about writing code, but the code ends up being less important than the architecture, and the architecture ends up being less important than social issues.

• Architecture is downstream of incentives, which are downstream of org structure — Conway's law as the real curriculum
• rust-analyzer's no-rustc-build, no-C-deps, seconds-long test suite was a deliberate move to attract deep contributors
• Features were sandboxed with catch_unwind and required to work on immutable snapshots, so weekend contributors could ship without poisoning the core
• 'Speedrun the four stages of grief to acceptance' on incentives you can't change
• Recommends Bernhardt's Boundaries talk, Pieter Hintjens / ZeroMQ writing, Jamii's 'Reflections on a decade of coding', Ted Kaminski's notes

before vibe-coding it was difficult and time consuming to implement such fancy effects, but now it takes a single prompt and a few hundred tokens, and you have a fancy effect instead of the nice pointer.

• Vibe-coding has dropped the cost of custom cursor effects from hours to a single prompt
• Sites are replacing the OS pointer with bespoke designs that hurt click accuracy and discoverability
• The pointer's slight tilt and pointed tip exist for accumulated UI reasons — they were not arbitrary
• Lower implementation cost shifts the constraint from 'can I build it' to 'should I build it'

• Runs a 1 trillion parameter Kimi K2.5 locally at about 4 tokens/second
• Uses discontinued Intel Optane Persistent Memory DIMMs — a tier between DRAM and SSD
• Surfaces a workaround for the memory-capacity wall blocking local frontier-scale models
• 633 upvotes and 107 comments on r/LocalLLaMA — community read is that this is a real path, not a meme

• Unsloth published Qwen3.6 27B and 35B-A3B quantizations with the multi-token prediction (MTP) head preserved
• Requires the in-flight llama.cpp MTP PR to actually use the speedup
• 420 upvotes, 141 comments — local-LLM users want speculative-style speedups from the base model itself