<h2>Must know</h2>
<ul>
<li><strong>Anthropic Claude Code source leak reveals internal agent logic</strong>: A misconfigured npm release accidentally exposed the full source maps for Anthropic’s Claude Code, allowing researchers to reconstruct the original logic and internal system prompts. The leak, attributed to a Bun production bug, uncovered an ‘undercover mode’ for hiding AI authorship in commits and an unreleased autonomous agent named KAIROS. While no customer data was compromised, the incident provides a rare, unvarnished look at Anthropic’s anti-distillation and terminal optimization techniques. <a href="https://app.daily.dev/feed-by-ids?id=7folff4vx&amp;id=gmKbBNZUJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Axios compromised in major npm supply chain attack</strong>: The widely used Axios library was hijacked via a maintainer’s old npm token, bypassing MFA to inject a malicious dependency named plain-crypto-js. This rogue package installs a Remote Access Trojan capable of stealing AWS keys and API tokens across Windows, macOS, and Linux. Developers should immediately verify they aren’t on versions 1.14.1 or 0.30.4 and rotate all environment credentials if these versions were installed. <a href="https://app.daily.dev/feed-by-ids?id=LtJWdahMA&amp;id=inEAYcCio&amp;id=dQpqFJWWR&amp;id=MPMQ2rBUG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>JetStream 3.0 arrives with heavy WebAssembly focus</strong>: Apple, Google, and Mozilla have jointly released JetStream 3.0, a major update to the cross-browser benchmark suite that now prioritizes real-world workloads over microbenchmarks. WebAssembly coverage has more than doubled to 20% of the suite, incorporating modern toolchains like Rust, Kotlin/Wasm, and Dart2wasm. The WebKit team used this release to drive significant JavaScriptCore improvements, including a new register allocator that is roughly 2x faster for large functions. <a href="https://app.daily.dev/posts/Ucbjrtf6l" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Cursor releases Composer 2 coding model</strong>: A specialized 1.04T parameter MoE model that reportedly outperforms Claude 4.6 on coding-specific benchmarks while reducing inference costs. <a href="https://app.daily.dev/posts/QhqZHaWTM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>PostgreSQL extension pg_textsearch brings BM25 ranking</strong>: Timescale’s new open-source extension adds production-ready, relevance-ranked full-text search directly to Postgres using a custom index type. <a href="https://app.daily.dev/posts/xeIapEcnQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MiniStack offers free local AWS emulation</strong>: An MIT-licensed alternative to LocalStack that runs 33 AWS services, including RDS and S3, in local containers with a 2-second startup time. <a href="https://app.daily.dev/posts/uZj72MK3a" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wayland Protocols 1.48 adds session management</strong>: The new XDG Session Management protocol finally allows Wayland clients to restore window positions and states across sessions. <a href="https://app.daily.dev/posts/60DR37TXb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Debezium 3.5 optimizes Oracle and MySQL connectors</strong>: The latest release features parallel multithreaded snapshots and a 50% reduction in memory bookkeeping for Oracle Change Data Capture. <a href="https://app.daily.dev/posts/frQ51l2Un" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Windows Console inherits open source Terminal features</strong>: Microsoft is merging Direct3D rendering, Sixel image support, and 10x faster scrolling from Windows Terminal back into the native console. <a href="https://app.daily.dev/posts/AwBjzoyRr" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ESLint Markdown plugin enables embedded code linting</strong>: The official plugin now supports linting JS, TS, and JSX blocks within Markdown files using the ESLint v9 flat config system. <a href="https://app.daily.dev/posts/hoFSxh6Ac" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The Shatter CLI disk space miracle</strong>: A tool claiming to ‘surgically’ reclaim gigabytes of disk space by deleting build artifacts was conveniently announced on April 1st. While the README promises cross-ecosystem dominance over npkill, the lack of a real developer name and the suspicious timing suggest this is just another holiday hoax for the README-star-collectors. Don’t go deleting your node_modules based on a prank. <a href="https://app.daily.dev/feed-by-ids?id=PY1Nl23uV&amp;id=wAMqGta3E" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Microsoft’s contextual options package is a solution looking for a problem</strong>: The experimental Microsoft.Extensions.Options.Contextual package tries to reinvent feature flagging using magic strings and complex receivers. It has fewer than 1,000 downloads and has been stuck in preview forever because it’s essentially a worse version of OpenFeature. It’s a classic case of over-engineering a simple configuration problem into a proprietary mess. <a href="https://app.daily.dev/posts/sBAZ63pbd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 2x productivity mandate is the new corporate fiction</strong>: Honeycomb’s SVP claims a ‘2x productivity mandate’ for AI integration while simultaneously admitting they don’t use hard metrics to track it to ‘prevent gaming.’ If you can’t measure it, it’s not a mandate; it’s a vibe-based press release designed to make the engineering department look like it’s keeping up with the AI hype cycle. <a href="https://app.daily.dev/posts/osQspcxBm" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
