<h2>Must know</h2>
<ul>
<li><strong>Axios npm package hit by sophisticated supply chain attack</strong>: The popular HTTP client Axios, with over 100 million weekly downloads, was compromised on March 31 after an attacker hijacked a lead maintainer’s account. Malicious versions 1.14.1 and 0.30.4 were published to inject a Remote Access Trojan targeting macOS, Windows, and Linux systems. Security firms Socket and StepSecurity report the malware communicates with a C2 server at <a href="http://sfrclak.com" target="_blank" rel="noopener nofollow">sfrclak.com</a> and attempts to self-delete to evade forensics; developers should immediately pin to safe versions 1.14.0 or 0.30.3. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=6mR1VFvvx&amp;id=Cs5sU7Y7b&amp;id=LtJWdahMA&amp;id=inEAYcCio&amp;id=RbLhoKQKe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>LiteLLM and Trivy compromised in PyPI pipeline breach</strong>: A supply chain attack targeted the LiteLLM package on PyPI, resulting in over 40,000 downloads of a malicious version (1.82.8) designed to exfiltrate cloud credentials, SSH keys, and Kubernetes configs. According to FutureSearch, the breach originated from a vulnerability in the Trivy scanner that granted attackers access to the publishing pipeline. This incident is part of a broader campaign by threat group TeamPCP, which has reportedly infected dozens of npm and PyPI packages using stolen tokens. <a href="https://app.daily.dev/feed-by-ids?id=VRnUelNCZ&amp;id=9Bs0jITq3&amp;id=FXTliE1qu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ollama integrates Apple MLX for accelerated local inference</strong>: Ollama has released a preview update that leverages Apple’s MLX framework to significantly speed up local LLM performance on Silicon Macs with at least 32GB of unified memory. The integration currently supports the Qwen3.5-35B-A3B model, which is optimized for coding and agentic tasks. This move, detailed on the Ollama Blog, aims to reduce latency for local AI agents like OpenClaw while maintaining data privacy and avoiding remote API costs. <a href="https://app.daily.dev/posts/onA13BGmb" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Ember 1.0.0 provides real-time terminal monitoring for FrankenPHP and Caddy</strong>: This zero-config TUI replaces full Prometheus stacks with per-thread visibility and status code breakdowns using only 15MB of RAM. <a href="https://app.daily.dev/posts/HJIIhUle4" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel RefreshDatabase vs DatabaseTransactions guide</strong>: A technical breakdown recommends RefreshDatabase for high isolation in async tests, while reserving Transactions for simple CRUD performance gains. <a href="https://app.daily.dev/posts/q8TtdwuwE" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Elixir v1.20.0-rc.4 adds process labeling and improved error reporting</strong>: The latest release requires Erlang/OTP 27+ and introduces Mix dependency override support alongside critical bug fixes for URI merging. <a href="https://app.daily.dev/posts/XJnBOpS09" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi eliminates static CI secrets across 70 repositories</strong>: By switching to OIDC and Pulumi ESC, the team now fetches ephemeral cloud credentials at runtime, removing persistent targets for attackers. <a href="https://app.daily.dev/posts/4QM6OAZyn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor launches self-hosted AI coding agents for enterprise</strong>: The new model allows companies like Notion and Brex to run agentic execution on their own infrastructure while coordinating via Cursor’s cloud. <a href="https://app.daily.dev/posts/vbcxvRyOK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Careless Whisper vulnerability affects WhatsApp and Signal</strong>: Researchers found that delivery receipts can be exploited to silently ping phones, leaking location patterns and device models via timing analysis. <a href="https://app.daily.dev/posts/X4aow21zN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Amper 0.10.0 introduces automatic JDK provisioning</strong>: The build tool update includes a Maven-to-Amper converter and improved Ktor plugin assistance for IntelliJ IDEA Ultimate. <a href="https://app.daily.dev/posts/tJTbxIhrW" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI ROI crisis and the governance industrial complex</strong>: JetBrains is sounding the alarm on an ‘AI ROI crisis’ to sell their new JetBrains Central platform, because apparently, you can’t just run a script anymore without a ‘semantic context layer.’ It’s the classic pivot from ‘AI will do your job’ to ‘AI is so expensive and messy you need to buy our governance suite to track why it’s failing.’ <a href="https://app.daily.dev/posts/ZyxkzXSm0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding is the new technical debt</strong>: Promotional stories are hailing ‘vibe-coding’—where non-coders prompt their way to a functional game—as a creative revolution. In reality, senior engineers are already reporting burnout acting as ‘human compilers’ for this ‘almost-right’ AI slop that shifts the bottleneck from writing code to the nightmare of reviewing it. <a href="https://app.daily.dev/feed-by-ids?id=19kk3AqHi&amp;id=RBiGlsyQf&amp;id=Y2oK9SBvQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 0.6 percent optimization trap</strong>: <a href="http://Builder.io" target="_blank" rel="noopener nofollow">Builder.io</a> claims that optimizing coding time only impacts 0.6% of the total production cycle, yet their solution is… more AI tools to ‘invert the workflow.’ It’s a bold strategy to tell everyone they are optimizing the wrong thing while simultaneously selling the exact type of tool that supposedly doesn’t move the needle. <a href="https://app.daily.dev/posts/hzhT2J9Is" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
