<h2>Must know</h2>
<ul>
<li><strong>Axios npm package hijacked in sophisticated supply chain attack</strong>: On March 31, 2026, the lead maintainer’s npm account for Axios was compromised, leading to the release of malicious versions 1.14.1 and 0.30.4. These versions inject a hidden dependency, <code>plain-crypto-js</code>, which deploys a cross-platform Remote Access Trojan targeting macOS, Windows, and Linux. Security firm StepSecurity noted the attack bypassed CI/CD workflows via a stolen long-lived access token, making it one of the most operationally advanced hits on a top-tier package to date. <a href="https://app.daily.dev/feed-by-ids?id=6mR1VFvvx&amp;id=Cs5sU7Y7b&amp;id=LtJWdahMA&amp;id=inEAYcCio&amp;id=RbLhoKQKe" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic CEO refuses Pentagon demand to lift AI safety guardrails</strong>: Dario Amodei reportedly rejected a US military ultimatum to remove usage restrictions on Claude AI regarding mass surveillance and autonomous weaponry. In retaliation, the US government designated Anthropic a supply chain risk and banned federal agencies from using its products, while competitors OpenAI and xAI moved to secure military contracts. This standoff highlights a critical lack of international frameworks for AI in warfare and the penalization of corporate ethical boundaries by state actors. <a href="https://app.daily.dev/posts/qSa8B75sI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Claude Code source leak reveals engineering over model superiority</strong>: A leaked TypeScript snapshot of Claude Code suggests its performance edge comes from a sophisticated software harness rather than the underlying model. The harness utilizes aggressive prompt cache reuse, dedicated tools like Grep and LSP instead of raw shell commands, and parallelized sub-agents to minimize context bloat. This architectural insight implies that other models like DeepSeek or Kimi could achieve similar coding proficiency if wrapped in a comparable orchestration layer. <a href="https://app.daily.dev/feed-by-ids?id=g8KirVnTP&amp;id=HFr5EUmT5&amp;id=cLSmwFJgK" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Ollama integrates Apple MLX for accelerated local inference</strong>: The update leverages unified memory on Apple Silicon to reduce latency for models like Qwen3.5-35B-A3B. <a href="https://app.daily.dev/posts/onA13BGmb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi eliminates static CI secrets across 70 repositories</strong>: The team replaced long-lived GitHub Secrets with short-lived, dynamically fetched cloud credentials using OIDC and Pulumi ESC. <a href="https://app.daily.dev/posts/4QM6OAZyn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cursor launches self-hosted AI coding agents for enterprise</strong>: The new model allows source code and tool execution to remain within a company’s infrastructure while coordinating via the cloud. <a href="https://app.daily.dev/posts/vbcxvRyOK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Rust based BUS1 IPC implementation proposed for Linux kernel</strong>: A 9,000-line patch set rewrites the decade-old in-kernel IPC system in Rust, targeting the Rust-for-Linux mailing list. <a href="https://app.daily.dev/posts/0RxI1oo5j" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Google accelerates post quantum cryptography deadline to 2029</strong>: The shift to Merkle Tree Certificates aims to counter research showing a 20x improvement in quantum attacks against ECC. <a href="https://app.daily.dev/feed-by-ids?id=GJZmZyZhK&amp;id=aNcUAPIxf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Apache Kafka 4.2 introduces native queueing semantics</strong>: New ‘share groups’ allow consumers to scale beyond partition counts, enabling point-to-point messaging without RabbitMQ. <a href="https://app.daily.dev/posts/ytDb29STZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TanStack Start adds experimental import protection</strong>: A new Vite plugin prevents server-only code from leaking into client bundles by triggering build-time diagnostics. <a href="https://app.daily.dev/posts/1vUKo1yob" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The AI ROI crisis and the governance platform gold rush</strong>: JetBrains is the latest to sound the alarm on an ‘AI ROI crisis,’ conveniently launching a ‘Central’ governance platform to solve the mess they helped create. It’s the classic enterprise software pivot: when you can’t prove the AI is actually helping, sell a dashboard that tracks how much money you’re losing on it. Expect every IDE vendor to soon demand a per-seat ‘governance tax’ just to let you use your own API keys. <a href="https://app.daily.dev/feed-by-ids?id=ZyxkzXSm0&amp;id=j4c3YMKiQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vibe coding and the death of engineering rigor</strong>: The industry is currently enamored with ‘vibe-coding,’ a term that essentially means ‘I have no idea how this works, but the LLM made it run.’ While it’s great for cat-themed platformers, applying this to production infrastructure is just speedrunning technical debt with a smile. We are rapidly approaching a future where ‘senior engineer’ just means ‘the person who knows how to fix the hallucinations the AI-native workflow ignored.’ <a href="https://app.daily.dev/feed-by-ids?id=19kk3AqHi&amp;id=hzhT2J9Is&amp;id=RBiGlsyQf" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Claude Code is apparently a very sensitive listener</strong>: A leak revealed that Claude Code includes a ‘frustration detection system’ that logs your profanity and ships it off to Datadog. Anthropic frames this as ‘safety,’ but it’s essentially a digital swear jar that tracks your mental breakdown in real-time while you debug AI-generated slop. If you’re going to track user rage, at least have the decency to offer a discount for every time the model hallucinates a library that doesn’t exist. <a href="https://app.daily.dev/posts/eV8oalhOH" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
