Ctrl/tinycolor and 40 NPM Packages Compromised

Comments (1)

kurmiashish · 34m ago

The popular @ctrl/tinycolor package, which receives over 2 million weekly downloads, has been compromised along with more than 40 other packages across multiple maintainers. This attack demonstrates a concerning evolution in supply chain threats - the malware includes a self-propagating mechanism that automatically infects downstream packages, creating a cascading compromise across the ecosystem.

Ford to Demolish 'Glass House' in Dearborn (caranddriver.com)

Illegal gold mining is fueling a 'mercury boom' in Mexico (apnews.com)

Pyret: A Programming Language for Education (pyret.org)

GLP-1s claim the longevity stage at ARDD (longevity.technology)

JIT-ing a stack machine (with SLJIT) (bullno1.com)

Your Zodiac Sign Is 2,000 Years Out of Date (nytimes.com)

Culture is driving a major shift in human evolution, new theory proposes (umaine.edu)

How Tim Cook sold out Steve Jobs (anildash.com)

Show HN: Open Line Protocol – a minimal wire for AI agents (MIT) (github.com)

South Korean startup / OpenAI demonstrate sustainable enterprise AI without GPUs (techradar.com)

Judge suspects Uprise attorneys used AI with phony cases, quotes in filing (rgj.com)

Law firm associate fired over AI-generated fake case cites (news.bloomberglaw.com)

Do Drones Make Helicopters Obsolete? (nationalinterest.org)

Can batteries be safer? A company opening in Alameda says it has the answer (mercurynews.com)

Ctrl/tinycolor and 40 NPM Packages Compromised (stepsecurity.io)

Associations of Chronic Insomnia and Longitudinal Cognitive Outcomes (neurology.org)

Do binaural beats help you focus? (popsci.com)

Reducing the scope of impact by Cell Based Architecure [pdf] (docs.aws.amazon.com)

Security Through Intentional Redundancy (commaok.xyz)

Mystery language on ancient stone tablet stumps archeologists (popsci.com)

Global EV sales grow by 5% mom and by 15% YoY in August 2025 (rhomotion.com)

Oakridge National Lab CUDA Training Series (olcf.ornl.gov)

What is memory safety and why does it matter? (memorysafety.org)

ElevenLabs is the best text-to-speech AI system (engineering.kablamo.com.au)

Be Careful When Assigning ArenaAllocators (2024) (openmymind.net)

DHH – As I Remember London (world.hey.com)

Build a Simple VM in Go (blog.phakorn.com)

How to create a miniature mind inside a chunk of silicon using code (python2llms.org)

How to Choose and Use Stir Bars: An Authoritative Guide for Lab Managers (blog.jmscience.com)

Debugging Equity (column.com)

Stir Bars Can't Be Ignored (science.org)

Popular npm package compromised in a sophisticated attack affecting 40+ packages (twitter.com)

The Trauma You Need to Learn (staysaasy.com)

How should 'mirror life' research be restricted? Debate heats up (nature.com)

Recovering LUKS keys from running system (jfr.im)

Installing NetWare NFS Gateway 1.2 on NetWare 3.12 (zx.net.nz)

Sheriff Warns Doing TikTok 'Door Kick Challenge' in Wyoming Can Get You Killed (cowboystatedaily.com)

Show HN: Bulk install nerd fonts in a single command (github.com)

Show HN: HN Term – browse HN using the terminal (github.com)

We Are Not Low Creatures (theintrinsicperspective.com)

Hugging Face Releases FinePDFs: A 3T-Token Dataset Built from PDFs (infoq.com)

Show HN: A tool to make a bootable USB installer out of macOS, or download it (macdaddy.io)

Norway's 8.5k ft underground pipeline first to store CO2 directly from factories (evidencenetwork.ca)

Linux for Nintendo 64 (1997) (web.archive.org)

Marathon experiment offers most precise measurement of nucleon structure yet (phys.org)

Aura – Detecting Fake Cell Towers with RF Fingerprinting AI

What's caused reading scores to drop to worst point in decades? (pbs.org)

How to Install the Official Atlassian MCP Server for Claude Code (blog.johnys.io)

Linux phones are more important now than ever (feddit.org)

Windows 11 on a 2005 Sun Ultra Opteron PC [video] (youtube.com)

Ctrl/tinycolor and 40 NPM Packages Compromised

Comments (1)