<h2>Must know</h2>
<ul>
<li><strong>CanisterWorm hits npm with autonomous propagation</strong>: Socket’s research team identified a sophisticated worm-enabled attack affecting over 29 packages across the @emilgroup and @teale.io namespaces. The malware harvests npm tokens from environment variables and .npmrc files to autonomously republish a Python backdoor across all accessible packages. This marks a significant escalation in supply chain threats, moving from static malicious injections to self-propagating worms within the registry. <a href="https://app.daily.dev/posts/crpaAf7jK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pinterest slashes carousel code by 90 percent using native CSS</strong>: The Pinterest engineering team successfully replaced a 2,000-line JavaScript carousel with just 200 lines of native CSS, resulting in a 15% improvement in page load times. By leveraging modern CSS features, they eliminated main-thread blocking and removed the jank associated with heavy animation libraries. This shift highlights the increasing viability of native web APIs to replace long-standing JavaScript-heavy UI patterns. <a href="https://app.daily.dev/posts/OmQ3qCuNd" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Helm 4 adopts WebAssembly for sandboxed plugin security</strong>: The upcoming Helm 4 release integrates the Extism WebAssembly plugin to provide a secure, isolated runtime for Kubernetes deployment tools. Unlike Helm 3, which ran plugins with full host access, this new architecture creates an ‘invisible sandbox’ that restricts unauthorized network and file system operations. This move significantly hardens the Kubernetes supply chain by ensuring mandatory signing and clear provenance for all plugins. <a href="https://app.daily.dev/posts/uqge8CcV2" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Mamba 3 release prioritizes inference efficiency</strong>: The new State Space Model architecture outperforms Llama 3.2 1B in prefill and decode latency by removing causal convolutions and using exponential-trapezoidal discretization. <a href="https://app.daily.dev/posts/Of3MWahiL" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Ubuntu 26.04 adds visual feedback to sudo</strong>: The ‘Resolute Raccoon’ LTS release will finally display asterisks during password entry, a change driven by the new Rust-based sudo-rs utility. <a href="https://app.daily.dev/posts/AvXNa15IP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Project NOMAD offers a self-hosted offline knowledge stack</strong>: This Docker-orchestrated ‘survival computer’ bundles Ollama, Wikipedia, and maps into a single-command install for zero-internet environments. <a href="https://app.daily.dev/posts/H7iMtIlvB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Curl to drop RTMP support in April</strong>: Citing zero test coverage and a stagnant upstream library, curl version 8.20.0 will remove all six RTMP URL schemes after 16 years of support. <a href="https://app.daily.dev/posts/LYMsD08n0" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Capacitarr automates media storage management</strong>: A new Go-based intelligent disk manager for the *arr ecosystem that uses watch history and ratings to prune low-value files when space is low. <a href="https://app.daily.dev/posts/37KMYIvgJ" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FilmKit brings browser-based RAW conversion to Fujifilm</strong>: Using WebUSB and reverse-engineered PTP protocols, this tool lets you manage camera presets and trigger RAW processing directly from a browser. <a href="https://app.daily.dev/posts/HZLlsCclK" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Tinygrad framework powers production autonomous driving</strong>: The minimalist neural network framework is now being used by <a href="http://comma.ai" target="_blank" rel="noopener nofollow">comma.ai</a> for openpilot inference, proving its viability beyond academic interest. <a href="https://app.daily.dev/posts/wetFM0jf1" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>Nvidia GTC and the 50 trillion dollar hallucination</strong>: Jensen Huang spent 150 minutes pitching a future where AI agents and robots represent a $85 trillion market, which is roughly the current GDP of the entire planet. Despite these ‘modest’ projections, investors were so unimpressed by the lack of actual enterprise ROI data that the stock actually dropped during the keynote. It’s a masterclass in selling the shovel while the gold mine is still just a prompt in a slide deck. <a href="https://app.daily.dev/feed-by-ids?id=tHngHAYCv&amp;id=Cskx8eMnw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>H and R Block installs a permanent TLS backdoor</strong>: The 2025 tax software ‘helpfully’ installs a root CA certificate and its private key into the Windows trusted store, effectively inviting man-in-the-middle attacks. Even better, the vulnerability persists after you uninstall the software, because apparently, security is just a suggestion when there are tax forms to file. H&amp;R Block has acknowledged the issue but hasn’t bothered to fix it, proving once again that ‘enterprise grade’ is often a synonym for ‘negligent’. <a href="https://app.daily.dev/posts/1vUhuGLGk" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>The AI home automation elf that nobody asked for</strong>: Andrej Karpathy built ‘Dobby’, an AI agent that autonomously reverse-engineered his entire home network to create a dashboard for his shades and pool. While technically impressive, it’s the ultimate ‘senior engineer with too much time’ project that ignores the fact that most smart home APIs are held together by duct tape and prayers. We’re one hallucination away from the AI deciding ‘sleepy time’ means locking the doors and turning the HVAC to 90 degrees. <a href="https://app.daily.dev/posts/SHMkCvdE8" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
