<h2>Must know</h2>
<ul>
<li><strong>Massive npm supply chain attacks hit Axios and LiteLLM</strong>: A sophisticated North Korean-linked campaign hijacked the maintainer account of Axios, a library with 100 million weekly downloads, to inject a cross-platform Trojan into versions 1.14.1 and 0.30.4. Simultaneously, the LiteLLM Python package was compromised via a breach of the Trivy scanner, exfiltrating credentials from over 500,000 machines. Security researchers at Unit 42 and Google urge developers to rotate all secrets and pin dependencies to safe versions immediately. <a href="https://app.daily.dev/feed-by-ids?id=0Uj2ass08&amp;id=AZHl01Fi2&amp;id=zQFdPLgVT&amp;id=Y2vRayEM1&amp;id=YKPH3yXt5&amp;id=dfUjvXabl" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic leaks Claude Code source via npm mishap</strong>: Anthropic accidentally exposed over 600,000 lines of TypeScript source code for its Claude Code agent through a massive sourcemap file in a recent npm update. The leak revealed unreleased features like ‘KAIROS,’ an autonomous background agent, and ‘anti-distillation’ code designed to poison competitor training data. While model weights remain safe, the community has already mirrored the logic into open-source forks like ‘Claw Code’ despite aggressive DMCA takedowns. <a href="https://app.daily.dev/feed-by-ids?id=0p3TijjFW&amp;id=CcLi61NgL&amp;id=KCzMPGNnq&amp;id=Oi9XM9F4I&amp;id=UhHECzHyw&amp;id=VwmRdyAFQ&amp;id=eVvJWhAT4&amp;id=nOFJ29Zgp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Cloudflare Workers get 100x faster with Dynamic Loader</strong>: Cloudflare has launched a Dynamic Worker Loader in open beta, allowing AI agents to execute generated code within sandboxed V8 isolates with near-instant boot times. This ‘Code Mode’ approach replaces sequential tool calls with typed TypeScript APIs, reportedly reducing LLM token usage by 81%. The system utilizes Memory Protection Keys and custom sandboxing to mitigate Spectre-style side-channel attacks during runtime execution. <a href="https://app.daily.dev/posts/MtPJm1761" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>MiniStack launches as a free 33-service local AWS emulator</strong>: A lightweight, MIT-licensed alternative to LocalStack that runs real Postgres and Docker containers with 2-second startup times. <a href="https://app.daily.dev/posts/uZj72MK3a" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>MotherDuck adds Postgres wire protocol support</strong>: You can now connect any standard PostgreSQL client or BI tool directly to MotherDuck without needing specific DuckDB libraries. <a href="https://app.daily.dev/posts/ghQhwqUmP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Supabase documentation is now browseable via SSH</strong>: AI agents can now use bash commands like grep and ls over SSH to search Supabase docs, reducing API hallucination risks. <a href="https://app.daily.dev/posts/hcafvPXey" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ESLint v10 drops legacy config and old Node versions</strong>: The final transition to flat config is here, removing the legacy eslintrc system and narrowing support to Node 20+. <a href="https://app.daily.dev/posts/kSjKYf85g" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Wayland Protocols 1.48 adds long-awaited session management</strong>: The new XDG Session Management protocol finally allows Wayland clients to restore window positions and states across reboots. <a href="https://app.daily.dev/posts/60DR37TXb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Raspberry Pi prices spike due to global DRAM shortage</strong>: LPDDR4 costs have risen sevenfold, forcing price hikes of up to $150 on high-RAM models like the 16GB Pi 5. <a href="https://app.daily.dev/posts/lQotqYWmF" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Arch Installer 4.0 gets a major Python TUI overhaul</strong>: The installer has migrated to the Textual framework, enabling a cleaner UI that doesn’t freeze during background operations. <a href="https://app.daily.dev/posts/5UR81e2PY" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>NVIDIA claims its new Linux driver was written by an LLM</strong>: NVIDIA dropped a ‘preview’ driver on April 1st claiming Claude Sonnet wrote ‘nearly all’ the code under ‘strong human direction.’ While they’re busy shipping AI-generated kernel code, the rest of us are wondering if the ‘human direction’ was just clicking ‘Accept’ on a hallucinated pull request. It’s a classic April Fools’ wrapper on a real feature release for HDR support. <a href="https://app.daily.dev/posts/z6fJhldHb" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The 2-hour AI work week is finally here</strong>: Various ‘thought leaders’ are flooding the zone with claims that AI has reduced the engineering workday to two hours of ‘vibe coding.’ This ignores the reality that most teams still spend 75% of their time manually reviewing AI-generated garbage to avoid production meltdowns. It’s a great narrative for selling subscriptions, but a terrible one for actually shipping stable software. <a href="https://app.daily.dev/feed-by-ids?id=eVvJWhAT4&amp;id=as4j2VsOZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Perplexity AI claims it saved 3 years of labor in a month</strong>: Perplexity is touting that its ‘Enterprise’ platform completed 3.25 years of human work in four weeks, supposedly saving $1.6M. This assumes that every token generated is equivalent to a high-value human work hour, a metric so inflated it makes crypto whitepapers look conservative. In reality, it’s just a very expensive way to automate the same RAG workflows everyone else is already running. <a href="https://app.daily.dev/posts/FOKINOtLJ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
