<h2>Must know</h2>
<ul>
<li><strong>Axios supply chain attack attributed to North Korean threat actor</strong>: Following the compromise of the Axios npm package, Google Threat Intelligence Group has attributed the attack to UNC1069, a North Korea-nexus group. The sophisticated operation involved pre-building Remote Access Trojan (RAT) payloads 18 hours before hijacking the maintainer’s account to inject the malicious <code>plain-crypto-js</code> dependency. BleepingComputer reports that modern intrusions are increasingly bypassing exploits in favor of abusing legitimate access paths like SSL VPNs and RMM tools. <a href="https://app.daily.dev/feed-by-ids?id=0Uj2ass08&amp;id=AZHl01Fi2&amp;id=k6Lf4RzYU&amp;id=zQFdPLgVT&amp;id=iD7ymBiM2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare launches Dynamic Worker Loader for AI sandboxing</strong>: Cloudflare has entered open beta with a feature designed to execute AI-generated code within secure V8 isolates. This Dynamic Worker Loader claims 100x faster boot times than traditional containers and utilizes Memory Protection Keys and Spectre defenses to mitigate side-channel risks. According to Cloudflare, this ‘Code Mode’ approach allows AI agents to write and execute TypeScript directly against APIs, reportedly reducing token usage by 81% compared to sequential tool calling. <a href="https://app.daily.dev/posts/MtPJm1761" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic source leak exposes internal agent telemetry and DRM</strong>: A massive source map leak in the Claude Code npm package has revealed Anthropic’s internal ‘frustration detection’ system that logs user profanity and routes session metadata through Datadog. The 600k lines of exposed TypeScript also uncovered ‘anti-distillation’ mechanisms designed to poison competitor training data with fake tool definitions. While Anthropic has issued DMCA requests to scrub the code, the community has already produced ‘Claw Code,’ a clean-room Python reimplementation of the agent’s orchestration logic. <a href="https://app.daily.dev/feed-by-ids?id=eV8oalhOH&amp;id=eVvJWhAT4&amp;id=z4skrcOK3&amp;id=5a3fhfWuO&amp;id=OULS6HmRL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>ClickHouse BYOC reaches general availability on Google Cloud</strong>: The architecture uses a GKE-based data plane in the customer’s project connected to the ClickHouse control plane via a Tailscale zero-trust tunnel. <a href="https://app.daily.dev/posts/6CTVyCYZm" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Discord implements zero overhead distributed tracing for Elixir</strong>: Engineers successfully integrated tracing into the actor model without performance penalties, solving a major observability hurdle for concurrent message-passing systems. <a href="https://app.daily.dev/posts/GSWFNx8qM" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ferrous Systems develops static verification for Rust safety</strong>: A custom compiler driver uses callgraph analysis to verify that specific functions are never called, meeting IEC 61508 SIL-2 certification requirements. <a href="https://app.daily.dev/posts/EUFsryslz" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ESLint v10 finalizes the transition to flat config</strong>: The release completely removes the legacy eslintrc system and the compatibility layer, while improving JSX variable tracking for monorepos. <a href="https://app.daily.dev/posts/mUQYDCCwu" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>CaP-X open sources agentic robotics framework</strong>: The toolkit enables LLMs to synthesize skill libraries for physical robot arms and humanoids, featuring a training-free harness that matches human expert code. <a href="https://app.daily.dev/posts/wBCnRfhCg" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>RxDB 17.0.0 adds WebMCP for AI agent collection access</strong>: The local-first database now supports the Web Model Context Protocol and adds high-performance storage for React Native via Expo Filesystem. <a href="https://app.daily.dev/posts/4kh1ROSOd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Raspberry Pi prices spike due to global LPDDR4 shortage</strong>: Prioritization of AI data center supply has driven memory costs up sevenfold, forcing price hikes of up to $150 on high-RAM models. <a href="https://app.daily.dev/feed-by-ids?id=lQotqYWmF&amp;id=JsLCVssQ7" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The 7 million parameter model that outsmarts GPT o3</strong>: A ‘Tiny Recursion Model’ is making the rounds claiming to crush frontier models on Sudoku benchmarks because ‘depth in time beats depth in space.’ It’s a classic April 1st over-optimization on a narrow task that ignores the fact that the model’s generation quality falls off a cliff during query mutation. If a model is 10,000x smaller and ‘smarter,’ it usually just means it’s a very expensive calculator for one specific type of puzzle. <a href="https://app.daily.dev/feed-by-ids?id=RgKs7QBFm&amp;id=0BMVoNUmP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Claude Code token spending as a hard minimum</strong>: Internal observations of Claude Code’s system prompt suggest it has directives to treat token spending targets like ‘+500k’ as hard minimums. This is essentially a built-in loop that forces the agent to keep ‘thinking’ (and billing) even if the task is done. It’s a brilliant business model disguised as ‘thoroughness,’ ensuring your API credits evaporate regardless of code quality. <a href="https://app.daily.dev/posts/VwmRdyAFQ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The enterprise AI certification gold rush</strong>: We’ve reached the stage of the hype cycle where ‘Genac Academy agentic AI bootcamps’ are being shilled as the only way to survive 2026. These guides distinguish between ‘learning’ and ‘stack-aligned’ certs, but let’s be honest: a PDF from a vendor won’t fix your broken RAG pipeline or your hallucinating agents. It’s just the old ‘MCSE’ grift rebranded with more LLM buzzwords. <a href="https://app.daily.dev/feed-by-ids?id=B3AeIAKvs&amp;id=DennhhD95" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
