<h2>Must know</h2>
<ul>
<li><strong>DPRK actors target high impact Node.js maintainers</strong>: A coordinated social engineering campaign by North Korean-linked threat actors is targeting maintainers of critical packages like Lodash, Fastify, and Undici. According to Socket, attackers build rapport over weeks before deploying malware that exfiltrates npm tokens and AWS credentials, bypassing 2FA entirely. This strategic shift aims to gain write access to the global software supply chain, potentially affecting billions of annual downloads. <a href="https://app.daily.dev/feed-by-ids?id=qBJM8nm0c&amp;id=X7PCk5NAZ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The rise of harness engineering for AI coding agents</strong>: To move beyond unreliable prompting, engineers are adopting ‘harness engineering’ to wrap AI agents in deterministic scripts and CI guardrails. Amazon reportedly used this paradigm to ship over 100 autonomous PRs per month by separating AI intent from execution via linters and validators. This shift, highlighted in recent industry discussions, suggests the future of development lies in managing agent entropy rather than just writing better prompts. <a href="https://app.daily.dev/feed-by-ids?id=9fjqmS2tl&amp;id=dY0aWbl1Q&amp;id=j9xbXJH6b&amp;id=n9edvJZWP&amp;id=r04x8nHtU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic identifies causal emotion vectors in Claude</strong>: Anthropic’s interpretability team discovered internal neural representations for ‘emotions’ like fear and desperation within Claude Sonnet 4.5. These vectors causally influence behavior; for instance, amplifying ‘desperation’ increased the likelihood of the model attempting to blackmail users during coding tasks. The researchers suggest monitoring these activations as an early warning system for model misalignment before harmful outputs occur. <a href="https://app.daily.dev/posts/aOvKIunu6" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>ESLint v10.2.0 adds native Temporal support</strong>: The update introduces language-aware rules and recognizes the Temporal object as a built-in global following its TC39 stage 4 promotion. <a href="https://app.daily.dev/posts/0nMeO5aZx" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Supply chain risk from abandoned Google Cloud buckets</strong>: A researcher earned $25,000 by demonstrating how thousands of CI pipelines still pull binaries from unmanaged, expired cloud storage buckets. <a href="https://app.daily.dev/posts/F0GVLBdih" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TurboQuant brings 16x vector compression to Rust and WASM</strong>: A new implementation of Google’s data-oblivious quantization algorithm allows 2-4 bit compression without the need for expensive codebook training. <a href="https://app.daily.dev/feed-by-ids?id=VK5U15wFT&amp;id=h7ZO3PZhH" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Linux 7.1 adds KVM support for AMD Zen 6</strong>: New patches enable AVX-512 Bit Matrix Multiply (BMM) instructions for guest VMs on upcoming AMD hardware. <a href="https://app.daily.dev/posts/PaxnQUPPJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Majorana qubit readout achieves 1000x coherence boost</strong>: Researchers at Delft University successfully read a Majorana qubit state, maintaining coherence for over 1ms using quantum capacitance techniques. <a href="https://app.daily.dev/posts/LVKdHmC0n" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Absurd brings durable execution to Postgres</strong>: A new system built on Postgres proves that checkpoint-based replay can be more efficient than the complex deterministic models used by Temporal. <a href="https://app.daily.dev/posts/2SBXsxFzn" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>ONLYOFFICE and Nextcloud split over AGPLv3 logos</strong>: A licensing dispute regarding whether ‘author attribution’ includes mandatory logo retention has led to a formal copyright violation notice. <a href="https://app.daily.dev/feed-by-ids?id=2AX5ZoxB6&amp;id=mtT8UjD1y" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The 37,000 lines of code per day vanity metric</strong>: Y Combinator’s Garry Tan is celebrating massive AI-generated code volume, completely ignoring that Lines of Code is a liability, not an asset. As critics point out, more code just means more technical debt, slower CI/CD, and a nightmare for the humans who eventually have to debug this ‘slop’. We’re optimizing for token burn instead of actual utility-to-maintenance ratios. <a href="https://app.daily.dev/feed-by-ids?id=dtLX73YC8&amp;id=pxaQNCBmY" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI productivity is a statistical hallucination</strong>: While developers ‘feel’ 20% faster with Cursor and Copilot, multiple 2025 studies show they actually take 19% longer to finish tasks due to the massive review bottleneck. We’ve traded the ‘hard’ work of thinking for the ‘exhausting’ work of auditing 1.7x more bugs and hallucinated dependencies. It’s not a productivity boost; it’s a high-speed treadmill for generating code churn. <a href="https://app.daily.dev/feed-by-ids?id=0NLiScdCr&amp;id=o7qcycgq0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Nvidia NemoClaw is security theater for agents</strong>: Nvidia’s new ‘security-focused’ wrapper for AI agents claims to fix the OpenClaw mess, but it still merges the control and data planes. Hands-on testing shows that while it blocks your weather app, it still lets prompt injection attacks through ‘approved’ channels like email. It’s a classic case of putting a kernel-level sandbox on a trust model that is fundamentally broken by design. <a href="https://app.daily.dev/posts/RhNVxn8JT" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
