idk if i'll keep using a 3D curve for AI, but it was fun to try

MatCap (Material Capture) in Blender is a type of shader/material visualization. It's essentially a simplified shading system that uses a spherical environment map to fake complex lighting and materials.

MatCap works by:
- Using a pre-rendered spherical image that contains lighting, reflections, and material properties
- Mapping this image onto your 3D model based on the normal direction relative to the camera
- Creating the illusion of a fully shaded material with minimal processing

It's particularly useful for:
- Sculpting, when you want to clearly see the forms without waiting for complex lighting calculations
- Quick visualization of models
- Non-photorealistic rendering styles
- Performance-critical applications

You can find MatCap in Blender's viewport shading options, and there are many MatCap textures available to simulate different material appearances like metal, clay, plastic, etc.

While not a full shader in the traditional sense (like Principled BSDF), it functions as a simplified visualization method that can be very effective for certain workflows.

https://v0.dev (for web development, react)

https://a0.dev (for android development, react native)

Lazarus Targets Solana and Exodus Wallets, Infecting Hundreds of Software Developers

totally not Lazarus, someone stupid have been pushing some very obvious obfuscated js code to npm duh

and all of them are just like this

ffs at least they could TRY to intimate that group
this is so much noob behavior

is-buffer-validator, yoojae-validator, event-handle-package, array-empty-validator, react-event-dependency, and auth-validator

deobfuscated source code of cryptocurrency-stealing malware. for educational and security research only:

https://github.com/waki285/web3-malware-deobfuscated

Staging repo for development of native port of TypeScript, in Go

https://github.com/microsoft/typescript-go

CVE-2025-24813: Apache Tomcat RCE
The vulnerability allows an attacker to upload a malicious serialized payload to the server, leading to arbitrary code execution via deserialization when specific conditions are met.

It leverages improper handling of uploaded session files and deserialization mechanisms. By uploading a crafted payload to a writable directory (e.g., /uploads/../sessions/), an attacker can trigger deserialization, resulting in the execution of arbitrary commands on the target server.

affected versions:
- from 11.0.0-M1 through 11.0.2
- from 10.1.0-M1 through 10.1.34
- from 9.0.0.M1 through 9.0.98

- write up
- PoC (python)
- PoC (java)
- CWE-502: Deserialization of Untrusted Data
- CWE-706: Use of Incorrectly-Resolved Name or Reference
- CWE-44: Path Equivalence: 'file.name' (Internal Dot)

what does these three lines of code do? 🤔

var hello = "string literal";
var hello2 = ("string literal");

- The parentheses represent a grouping expression
- They would create a "parenthesized expression" node in your AST
- They're not ignored, but they might be semantically redundant
- they actually do make a difference in the AST structure

our AST would look something like:

without parentheses:

VariableDeclaration
  ├─ Identifier: "hello"
  └─ Initializer: StringLiteral "string literal"

with parentheses:

VariableDeclaration
  ├─ Identifier: "hello"
  └─ Initializer: ParenthesizedExpression
       └─ Expression: StringLiteral "string literal"

The parentheses create an extra node in the AST. During later phases like code generation, these parentheses might not affect the output code, but they are represented in the AST.

This distinction is important for preserving the exact structure of the source code, which matters for things like code formatting, refactoring tools, etc.

It seems like a new prompt injection vulnerability is found on VT.
(tho it seems fixed now)

1d30bfee48043a643a5694f8d5f3d8f813f1058424df03e55aed29bf4b4c71ce