Reddit Programming
211 subscribers
1.22K photos
124K links
I will send you newest post from subreddit /r/programming
Download Telegram
Adaptive Programming Systems for Humans and AI
https://www.reddit.com/r/programming/comments/1nibk9s/adaptive_programming_systems_for_humans_and_ai/

<!-- SC_OFF -->Just like buildings, software must be built to evolve. My new article explores the challenges that arise when humans and AI collaborate on programming and how we can mitigate these issues to create a more resilient ecosystem. https://gfrison.com/2025/adaptive-programming-systems <!-- SC_ON --> submitted by /u/gfrison (https://www.reddit.com/user/gfrison)
[link] (https://gfrison.com/2025/adaptive-programming-systems) [comments] (https://www.reddit.com/r/programming/comments/1nibk9s/adaptive_programming_systems_for_humans_and_ai/)
Self-replicating worm like behaviour in latest npm Supply Chain Attack
https://www.reddit.com/r/programming/comments/1niehal/selfreplicating_worm_like_behaviour_in_latest_npm/

<!-- SC_OFF -->We are investigating another npm supply chain attack. However, this one seems to be particularly interesting. Malicious payload include: Credential stealing using trufflehog scanning entire filesystem Exposing GitHub private repositories AWS credentials stealing Most surprisingly, we are observing self-replicating worm like behaviour if npm tokens are found from .npmrc and the affected user have packages published to npm. Exposed GitHub repositories can be searched here (https://github.com/search?q=%22Shai-Hulud+Migration%22&type=repositories&s=updated&o=desc). Take immediate action if you are impacted. Full technical details here (https://safedep.io/npm-supply-chain-attack-targeting-maintainers/). <!-- SC_ON --> submitted by /u/N1ghtCod3r (https://www.reddit.com/user/N1ghtCod3r)
[link] (https://safedep.io/npm-supply-chain-attack-targeting-maintainers/) [comments] (https://www.reddit.com/r/programming/comments/1niehal/selfreplicating_worm_like_behaviour_in_latest_npm/)
Crowdstrike Packages Infected with Malware (and other 167 packages infected as well)
https://www.reddit.com/r/programming/comments/1nihrpt/crowdstrike_packages_infected_with_malware_and/

<!-- SC_OFF -->sigh.... Kinda getting sick of writing these, absolutely insane the pace of supply chain attacks anyway...
The same ThreatActors behind the NX S1ngularity attack have launched a self-replicating worm, it's infected 187 packages and its terrifying. Yesterday a software developer Daniel Pereira (https://www.linkedin.com/in/daniel-pereira-b17a27160/)noticed a weird repo being created.... when he looked into it he was the first to realize that actually tinycolor (https://www.npmjs.com/package/@ctrl/tinycolor)was infected with malware. He reached out to multiple people, no one took him seriously until he reached out to Socket who discovered that 40 packages were compromised (https://socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages). Fun story, a little concerning but honestly this happens a lot so it's not crazy.... But then it got worse, so much worse. When I woke up, our lead researcher Charlie Erikson had discovered that actually a total of 187 packages were compromised (147 more than Socket had reported) 20 of which were from Crowdstrike. What does the worm do Harvest: scans the host and CI environment for secrets — process.env, scanning with TruffleHog, and cloud metadata endpoints (AWS/GCP) that return instance/service credentials. Exfiltrate (1) — GitHub repo: creates a repo named Shai-Hulud under the compromised account and commits a JSON dump containing system info, environment variables, and collected secrets. Exfiltrate (2) — GitHub Actions → webhook: drops a workflow .github/workflows/shai-hulud-workflow.yml that serializes ${{ toJSON(secrets) }}, POSTs them to an attacker webhook[.]site URL and writes a double-base64 copy into the Actions logs. Propagate: uses any valid npm tokens it finds to enumerate and attempt to update packages the compromised maintainer controls (supply-chain propagation). Amplify: iterates the victim’s accessible repositories, making them public or adding the workflow/branch that will trigger further runs and leaks. Its already turned 700 previously private repositories public (https://github.com/search?q=Shai-Hulud+Migration&ref=opensearch&type=repositories&s=updated&o=asc) This number will go down as they are removed by maintainers if you remeber the S1ngularity breach this is the exact same type of attacker and 100% the same attackers. The questions I have from that attack remain.... I have no idea why they are exfiltrating secrets to Public GitHub repos and not a private C2 servers (other than to cause chaos) The malicious versions have since been removed by Crowdstrikes account. Here is a total list of the packages compromised and their versions @ahmedhfarag/ngx-perfect-scrollbar 20.0.20 @ahmedhfarag/ngx-virtual-scroller 4.0.4 @art-ws/common 2.0.28 @art-ws/config-eslint 2.0.4, 2.0.5 @art-ws/config-ts 2.0.7, 2.0.8 @art-ws/db-context 2.0.24 @art-ws/di 2.0.28, 2.0.32 @art-ws/di-node 2.0.13 @art-ws/eslint 1.0.5, 1.0.6 @art-ws/fastify-http-server 2.0.24, 2.0.27 @art-ws/http-server 2.0.21, 2.0.25 @art-ws/openapi 0.1.9, 0.1.12 @art-ws/package-base 1.0.5, 1.0.6 @art-ws/prettier 1.0.5, 1.0.6 @art-ws/slf 2.0.15, 2.0.22 @art-ws/ssl-info 1.0.9, 1.0.10 @art-ws/web-app 1.0.3, 1.0.4 @crowdstrike/commitlint 8.1.1, 8.1.2 @crowdstrike/falcon-shoelace 0.4.1, 0.4.2 @crowdstrike/foundry-js 0.19.1, 0.19.2 @crowdstrike/glide-core 0.34.2, 0.34.3 @crowdstrike/logscale-dashboard 1.205.1, 1.205.2 @crowdstrike/logscale-file-editor 1.205.1, 1.205.2 @crowdstrike/logscale-parser-edit 1.205.1, 1.205.2 @crowdstrike/logscale-search 1.205.1, 1.205.2 @crowdstrike/tailwind-toucan-base 5.0.1, 5.0.2 @ctrl/deluge 7.2.1, 7.2.2 @ctrl/golang-template 1.4.2, 1.4.3 @ctrl/magnet-link 4.0.3, 4.0.4 @ctrl/ngx-codemirror 7.0.1, 7.0.2 @ctrl/ngx-csv 6.0.1,
6.0.2 @ctrl/ngx-emoji-mart 9.2.1, 9.2.2 @ctrl/ngx-rightclick 4.0.1, 4.0.2 @ctrl/qbittorrent 9.7.1, 9.7.2 @ctrl/react-adsense 2.0.1, 2.0.2 @ctrl/shared-torrent 6.3.1, 6.3.2 @ctrl/tinycolor 4.1.1, 4.1.2 @ctrl/torrent-file 4.1.1, 4.1.2 @ctrl/transmission 7.3.1 @ctrl/ts-base32 4.0.1, 4.0.2 @hestjs/core 0.2.1 @hestjs/cqrs 0.1.6 @hestjs/demo 0.1.2 @hestjs/eslint-config 0.1.2 @hestjs/logger 0.1.6 @hestjs/scalar 0.1.7 @hestjs/validation 0.1.6 @nativescript-community/arraybuffers 1.1.6, 1.1.7, 1.1.8 @nativescript-community/gesturehandler 2.0.35 @nativescript-community/perms 3.0.5, 3.0.6, 3.0.7, 3.0.8 @nativescript-community/sqlite 3.5.2, 3.5.3, 3.5.4, 3.5.5 @nativescript-community/text 1.6.9, 1.6.10, 1.6.11, 1.6.12 @nativescript-community/typeorm 0.2.30, 0.2.31, 0.2.32, 0.2.33 @nativescript-community/ui-collectionview 6.0.6 @nativescript-community/ui-document-picker 1.1.27, 1.1.28 @nativescript-community/ui-drawer 0.1.30 @nativescript-community/ui-image 4.5.6 @nativescript-community/ui-label 1.3.35, 1.3.36, 1.3.37 @nativescript-community/ui-material-bottom-navigation 7.2.72, 7.2.73, 7.2.74, 7.2.75 @nativescript-community/ui-material-bottomsheet 7.2.72 @nativescript-community/ui-material-core 7.2.72, 7.2.73, 7.2.74, 7.2.75 @nativescript-community/ui-material-core-tabs 7.2.72, 7.2.73, 7.2.74, 7.2.75 @nativescript-community/ui-material-ripple 7.2.72, 7.2.73, 7.2.74, 7.2.75 @nativescript-community/ui-material-tabs 7.2.72, 7.2.73, 7.2.74, 7.2.75 @nativescript-community/ui-pager 14.1.36, 14.1.37, 14.1.38 @nativescript-community/ui-pulltorefresh 2.5.4, 2.5.5, 2.5.6, 2.5.7 @nexe/config-manager 0.1.1 @nexe/eslint-config 0.1.1 @nexe/logger 0.1.3 @nstudio/angular 20.0.4, 20.0.5, 20.0.6 @nstudio/focus 20.0.4, 20.0.5, 20.0.6 @nstudio/nativescript-checkbox 2.0.6, 2.0.7, 2.0.8, 2.0.9 @nstudio/nativescript-loading-indicator 5.0.1, 5.0.2, 5.0.3, 5.0.4 @nstudio/ui-collectionview 5.1.11, 5.1.12, 5.1.13, 5.1.14 @nstudio/web 20.0.4 @nstudio/web-angular 20.0.4 @nstudio/xplat 20.0.5, 20.0.6, 20.0.7 @nstudio/xplat-utils 20.0.5, 20.0.6, 20.0.7 @operato/board 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.40, 9.0.41, 9.0.42, 9.0.43, 9.0.44, 9.0.45, 9.0.46 @operato/data-grist 9.0.29, 9.0.35, 9.0.36, 9.0.37 @operato/graphql 9.0.22, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.40, 9.0.41, 9.0.42, 9.0.43, 9.0.44, 9.0.45, 9.0.46 @operato/headroom 9.0.2, 9.0.35, 9.0.36, 9.0.37 @operato/help 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.40, 9.0.41, 9.0.42, 9.0.43, 9.0.44, 9.0.45, 9.0.46 @operato/i18n 9.0.35, 9.0.36, 9.0.37 @operato/input 9.0.27, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.40, 9.0.41, 9.0.42, 9.0.43, 9.0.44, 9.0.45, 9.0.46 @operato/layout 9.0.35, 9.0.36, 9.0.37 @operato/popup 9.0.22, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.40, 9.0.41, 9.0.42, 9.0.43, 9.0.44, 9.0.45, 9.0.46 @operato/pull-to-refresh 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.40, 9.0.41, 9.0.42 @operato/shell 9.0.22, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39 @operato/styles 9.0.2, 9.0.35, 9.0.36, 9.0.37 @operato/utils 9.0.22, 9.0.35, 9.0.36, 9.0.37, 9.0.38, 9.0.39, 9.0.40, 9.0.41, 9.0.42, 9.0.43, 9.0.44, 9.0.45, 9.0.46 @teselagen/bounce-loader 0.3.16, 0.3.17 @teselagen/liquibase-tools 0.4.1 @teselagen/range-utils 0.3.14, 0.3.15 @teselagen/react-list 0.8.19, 0.8.20 @teselagen/react-table 6.10.19 @thangved/callback-window 1.1.4 @things-factory/attachment-base 9.0.43, 9.0.44, 9.0.45, 9.0.46, 9.0.47, 9.0.48, 9.0.49, 9.0.50 @things-factory/auth-base 9.0.43, 9.0.44, 9.0.45 @things-factory/email-base 9.0.42, 9.0.43, 9.0.44, 9.0.45, 9.0.46, 9.0.47, 9.0.48, 9.0.49, 9.0.50, 9.0.51, 9.0.52, 9.0.53, 9.0.54 @things-factory/env 9.0.42, 9.0.43, 9.0.44, 9.0.45 @things-factory/integration-base 9.0.43, 9.0.44, 9.0.45 @things-factory/integration-marketplace 9.0.43, 9.0.44, 9.0.45 @things-factory/shell 9.0.43, 9.0.44, 9.0.45 @tnf-dev/api 1.0.8 @tnf-dev/core 1.0.8 @tnf-dev/js
1.0.8 @tnf-dev/mui 1.0.8 @tnf-dev/react 1.0.8 @ui-ux-gang/devextreme-angular-rpk 24.1.7 @yoobic/design-system 6.5.17 @yoobic/jpeg-camera-es6 1.0.13 @yoobic/yobi 8.7.53 airchief 0.3.1 airpilot 0.8.8 angulartics2 14.1.1, 14.1.2 browser-webdriver-downloader 3.0.8 capacitor-notificationhandler 0.0.2, 0.0.3 capacitor-plugin-healthapp 0.0.2, 0.0.3 capacitor-plugin-ihealth 1.1.8, 1.1.9 capacitor-plugin-vonage 1.0.2, 1.0.3 capacitorandroidpermissions 0.0.4, 0.0.5 config-cordova 0.8.5 cordova-plugin-voxeet2 1.0.24 cordova-voxeet 1.0.32 create-hest-app 0.1.9 db-evo 1.1.4, 1.1.5 devextreme-angular-rpk 21.2.8 ember-browser-services 5.0.2, 5.0.3 ember-headless-form 1.1.2, 1.1.3 ember-headless-form-yup 1.0.1 ember-headless-table 2.1.5, 2.1.6 ember-url-hash-polyfill 1.0.12, 1.0.13 ember-velcro 2.2.1, 2.2.2 encounter-playground 0.0.2, 0.0.3, 0.0.4, 0.0.5 eslint-config-crowdstrike 11.0.2, 11.0.3 eslint-config-crowdstrike-node 4.0.3, 4.0.4 eslint-config-teselagen 6.1.7 globalize-rpk 1.7.4 graphql-sequelize-teselagen 5.3.8 html-to-base64-image 1.0.2 json-rules-engine-simplified 0.2.1 jumpgate 0.0.2 koa2-swagger-ui 5.11.1, 5.11.2 mcfly-semantic-release 1.3.1 mcp-knowledge-base 0.0.2 mcp-knowledge-graph 1.2.1 mobioffice-cli 1.0.3 monorepo-next 13.0.1, 13.0.2 mstate-angular 0.4.4 mstate-cli 0.4.7 mstate-dev-react 1.1.1 mstate-react 1.6.5 ng2-file-upload 7.0.2, 7.0.3, 8.0.1, 8.0.2, 8.0.3, 9.0.1 ngx-bootstrap 18.1.4, 19.0.3, 19.0.4, 20.0.3, 20.0.4, 20.0.5 ngx-color 10.0.1, 10.0.2 ngx-toastr 19.0.1, 19.0.2 ngx-trend 8.0.1 ngx-ws 1.1.5, 1.1.6 oradm-to-gql 35.0.14, 35.0.15 oradm-to-sqlz 1.1.2 ove-auto-annotate 0.0.9 pm2-gelf-json 1.0.4, 1.0.5 printjs-rpk 1.6.1 react-complaint-image 0.0.32 react-jsonschema-form-conditionals 0.3.18 remark-preset-lint-crowdstrike 4.0.1, 4.0.2 rxnt-authentication 0.0.3, 0.0.4, 0.0.5, 0.0.6 rxnt-healthchecks-nestjs 1.0.2, 1.0.3, 1.0.4, 1.0.5 rxnt-kue 1.0.4, 1.0.5, 1.0.6, 1.0.7 swc-plugin-component-annotate 1.9.1, 1.9.2 tbssnch 1.0.2 teselagen-interval-tree 1.1.2 tg-client-query-builder 2.14.4, 2.14.5 tg-redbird 1.3.1 tg-seq-gen 1.0.9, 1.0.10 thangved-react-grid 1.0.3 ts-gaussian 3.0.5, 3.0.6 ts-imports 1.0.1, 1.0.2 tvi-cli 0.1.5 ve-bamreader 0.2.6 ve-editor 1.0.1 verror-extra 6.0.1 voip-callkit 1.0.2, 1.0.3 wdio-web-reporter 0.1.3 yargs-help-output 5.0.3 yoo-styles 6.0.326 <!-- SC_ON --> submitted by /u/Advocatemack (https://www.reddit.com/user/Advocatemack)
[link] (https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again) [comments] (https://www.reddit.com/r/programming/comments/1nihrpt/crowdstrike_packages_infected_with_malware_and/)
A new experiment: making Protobuf in C++ less painful (inspired by the old “why is Protobuf so clunky?” thread)
https://www.reddit.com/r/programming/comments/1niuy6j/a_new_experiment_making_protobuf_in_c_less/

<!-- SC_OFF -->Hey folks, Some hours back there was a lively discussion here: Why is Protobuf’s C API so clunky? (https://www.reddit.com/r/programming/comments/1nibv4y/why_is_protobufs_c_api_so_clunky_would_a/) I was in that thread too, tossing around ideas like “what if we could do user["id"] = 123; and have it fail at compile time if you tried user["id"] = "oops";”. The feedback I got there was super helpful — a few people pointed out I was basically forcing JSON-style dynamics into a static Protobuf world, which doesn’t really fit. That clicked with me. Since then I hacked on a small library/plugin called Sugar-Proto. It’s a protoc plugin that generates wrappers around your .proto messages, giving you something closer to a nlohmann/json feel, but still 100% type-safe and zero runtime reflection. Example: User user; UserWrapped u(user); u.name = "Alice"; u.id = 42; u.posts.push_back({{"title", "Hello"}, {"comments", {{"text", "Nice!"}}}}); Under the hood it’s just normal protobuf fields, no hidden runtime map lookups. The idea is: make the API less clunky without pretending it’s JSON. It’s early, not production-ready yet, but I’d love for people to kick the tires and tell me what feels right/wrong. Curious to hear if anyone else tried wrapping protobuf in a more ergonomic C++ way. Do you think this direction has legs, or is protobuf doomed to always feel a bit Java-ish in C++? <!-- SC_ON --> submitted by /u/Humble-Plastic-5285 (https://www.reddit.com/user/Humble-Plastic-5285)
[link] (https://github.com/illegal-instruction-co/sugar-proto) [comments] (https://www.reddit.com/r/programming/comments/1niuy6j/a_new_experiment_making_protobuf_in_c_less/)
Load Balancing: The "Zombie Server" Problem
https://www.reddit.com/r/programming/comments/1nj3sgn/load_balancing_the_zombie_server_problem/

<!-- SC_OFF --> Zombie Server Anatomy: Understanding servers that lie about their health Health Check Evolution: From basic pings to intelligent application-level checks Detection Strategies: Multi-layered approaches for catching zombie behaviors Real-World Patterns: How Netflix, Uber, and Amazon solve this problem Hands-On Implementation: Build a complete zombie detection system The Zombie Server Phenomenon A zombie server looks alive to your load balancer but cannot serve real user requests. Unlike completely dead servers that fail health checks, zombies pass basic connectivity tests while silently corrupting user experiences. <!-- SC_ON --> submitted by /u/Extra_Ear_10 (https://www.reddit.com/user/Extra_Ear_10)
[link] (https://systemdr.substack.com/p/load-balancing-the-zombie-server) [comments] (https://www.reddit.com/r/programming/comments/1nj3sgn/load_balancing_the_zombie_server_problem/)