Yes/No ? Justify your answer.

NPM Nightmare 🤯

Josh, the dude running Chalk (300M downloads a week), got tricked big time.

A fake email, looking like it was from npm (“support@npmjs.help”), said his account needed a 2FA reset. It seemed real, so he typed his login and code.

Boom hackers took over!
On Sep 8, they slipped bad code into chalk and 17 other packages. The code was a crypto thief, swapping real wallet addresses (like for Ethereum) with fakes to steal money from browsers.

Watch Fireship

Being a hyper-observer is a double edged sword.

Learn about Ethiopia while having fun. You will see a place for a few seconds and guess where it is on the map.
Check it out at 👉 geo.play.gebeta.app or you can use @gebetaPlayGeoBot

📍 gebeta.app

Highly recommend this if you’re planning on starting a company from the man himself Sam Altman.

https://youtu.be/CBYhVcO4WgI?si=kP-QFUfuoV0B9OeD

If you wanna convince your boss here's github's email template 😂
https://githubuniverse.com/convince

This is the craziest thing i've seen in a while 🙌🏽

Excited to announce the Auth.js project (formerly NextAuth.js) joins Better Auth

https://www.better-auth.com/blog/authjs-joins-better-auth

The JS Execution Model

[bsky]

The lion does not concern himself with edge cases.😂

Average vibe coder’s prompt 😭

Just sent my first-ever PR to the Laravel framework

added except() method to JsonResource class so you can easily exclude fields like:

(new UserResource($user))->except(['email', 'profile.ssn']);

Taylor Otwell reviewed it (yeah, that Taylor 👀) and said they’ll consider it for Laravel 13.

Didn’t get merged, but still feels awesome seeing my name in a Laravel PR thread 😎

Here's the link - https://github.com/laravel/framework/pull/57426

Ever wondered why we hash JWTs with a secret key if anyone can decode them anyway?

A JWT has three parts:
header.payload.signature

The header and payload are just Base64URL-encoded, not encrypted so yes, anyone can decode and read them. That’s intentional.

When a server receives a JWT, it recomputes the signature using its secret key and compares it to the token’s signature.
If someone changed even one letter in the payload like switching

"role":"user"

to

"role":"admin"

the signatures wouldn’t match and the token would be rejected. so hashing a JWT with a key isn’t about secrecy it’s about authenticity.
It proves the data is real, untampered, and issued by someone who holds the secret.