Today's digest · Sunday, September 20

The 10 things in AI/dev today.

LiveNext issue at 7:00 CET

Stories

#1 / TODAY

The Hacker News·1 min·23h agoFREE

CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

CrowdSec reported that an attack on the TanStack npm package resulted in a copy of 170 private GitHub repositories, according to The Hacker News. The report attributes the finding to CrowdSec and links the repository copying to the TanStack npm attack. The source provides no further detail on the method, the repositories involved, or the affected parties. The stated consequence is that private GitHub repositories were copied in connection with the npm attack.

The report links an npm package attack to the copying of 170 private GitHub repositories, a supply-chain risk for developers relying on npm packages.

securitynpmgithubsupply-chain

thehackernews.com

CrowdSec Says TanStack npm Attack Led to Copy of 170 Private GitHub Repositories

agent-usage NEW8: agents can torch a 5-hour window with no estimate

#2 / TOP STORY

DEV CommunityFREE

agent-usage NEW8: agents can torch a 5-hour window with no estimate

A DEV Community post titled "agent-usage NEW8: agents can torch a 5-hour window with no estimate" describes agents consuming a five-hour window without providing an estimate. The published excerpt consists almost entirely of injected CSS for a retro-themed article tag, including Win95-style and dark-theme styling rules, rather than substantive reporting. Because the body text contains no further detail, the source supports only the headline claim that agent usage can burn through a five-hour window with no estimate given.

I built a free carbon & page-weight auditor for the web — feedback welcome

#3 / TOP STORY

DEV CommunityFREE

I built a free carbon & page-weight auditor for the web — feedback welcome

A developer published a free carbon and page-weight auditor for the web on DEV Community, presenting it as a tool for checking page weight and carbon impact and inviting feedback. The post's supplied text consists largely of CSS for a retro-themed article styling challenge, including theme-aware rules for light and dark modes, rather than documentation of the auditor itself. The source therefore offers no technical details about how the tool measures pages or reports results.

aigest · daily

Get this every morning.

One email. The signal. Built for builders.

Free · Unsubscribe in one click · No trackers

// Worth knowing7 stories

BragJack attacks hijack AI browser agents through malicious extensions

The report links malicious browser extensions to hijacking of AI browser agents, a category developers increasingly rely on for automated web tasks.

securitybrowser-extensionsai-agentsmalware

BleepingComputer15h ago1mFREE

One engineer shipped 2,000 PRs a month to production. Verification is the key.

The source argues that automated verification, not generation speed, is what lets one engineer sustain 2,000 production pull requests a month.

agentsverificationdevopsdistributed-systems

The New Stack16h ago1mFREE

We made Playwright 2x faster and 80% more token efficient

Developers evaluating browser automation tooling should treat the reported 2x speed and 80% token-efficiency figures as unverified, since the supplied source contains no benchmarks or methodology.

playwrightstagehandbrowser-automationbenchmarks

Hacker News37h ago1mFREE

I Built Non-Autoregressive Decision Models a Year Ago. Then a Frontier Lab Called It a "Breakthrough"

The excerpt offers developers no technical detail about the non-autoregressive decision models, only the author's claim that a frontier lab later called the approach a breakthrough.

non-autoregressivedev-communitycssmodeling

Lobsters16h ago1mFREE

kicking the tires on jev (TypeSafe's System One model) with 2048

The source only supplies a title and link, so developers get no source-grounded detail about jev or the 2048 experiment beyond the gist's existence.

jevtypesafelobstersgist

Lobsters17h ago1mFREE

Persistent Databases in the Browser with DuckDB-Wasm and OPFS

The post points developers to a documented approach for keeping DuckDB-Wasm data persistent in the browser via OPFS instead of losing it on reload.

duckdbwasmbrowseropfs

Lobsters11h ago1mFREE

“Dormant deployments were quietly consuming storage”: Why Vercel tightened its free-tier rules

Developers on Vercel's free Hobby tier may see inactive deployments retained for less time as the platform responds to storage consumed by dormant deployments.

vercelhostingfree-tierdeployments

The New Stack17h ago1mFREE

// Yesterday12 stories