Sergei Lilichenko

npm install just got scarier. 84 malicious packages. Valid provenance. And a dead-man's switch. Last week, an attacker published 84 malicious versions across 42 @TanStack npm packages in 6 minutes. Every one had valid SLSA Build Level 3 provenance attestations — a first for a supply chain attack. The payload harvested GitHub tokens, AWS keys, SSH keys, npm tokens, even Claude Code sessions. And if you revoked your token while the malware was active? It ran rm -rf ~/ to wipe your home directory. TanStack wasn't alone. The same campaign hit Mistral AI, UiPath, OpenSearch — 170+ packages across npm and PyPI. These attacks are getting more common and more sophisticated. We've gone from typosquatting to forged provenance on legitimate packages. I built an open-source checker — 11 compromise indicators, one command. Repo: https://lnkd.in/d9BAqhc2 Run it and share with your team. #security #npm #supplychain #opensource #tanstack #devops

4

I found this really interesting, one of the more clearly articulated descriptions of how programming is changing, and the value of systems thinking https://lnkd.in/dsmwCbuP

11

1 Comment

Third time’s the charm… It's been a while since I last tested the #LLMs with my buffer manager challenge. Since then, newer versions of #ChatGPT, #Gemini, and #DeepSeek have all shown up, each claiming to be smarter and better at reasoning. So with nothing better to do on a Sunday afternoon, I figured… why not try again? For context, this is the same challenge I've been using all along: build a buffer manager for a 16K-entry, 128-bit wide memory, shared dynamically between 256 queues. It has to support one enqueue and one dequeue per cycle, no stalls. The data and link pointers must sit in SRAMs with two-cycle read latency. I even hinted that dual-linked-list structures might help hide the latency. Gemini did surprisingly well with enqueues—was able to handle them by the second attempt. But dequeues? It started to wobble, much like its cousins from OpenAI and DeepSeek. It kept swinging between overconfidence and excessive apologies. Feeding back the simulation results didn't help much. It fixed the obvious bugs - but once the corner cases rolled in, RTL quality dropped fast. It started breaking things that were previously working—an overfitting loop, but without any learning. At one point, it even gave up and reverted itself to a previous working version. Self-aware rollback! With things stuck at the same stage as four months ago, I decided to try something different... I went back to ChatGPT and taught her, step-by-step, how to design a pipeline. I wrote up a set of "commandments" - basic rules for designing fixed pipelines: how to name signals, handle hazards, deal with shared structures, and so on. I asked it to read, internalize, and then apply those principles—one pipeline stage at a time—to the challenge at hand. To my surprise, it did a decent job. 👏 It paused after typing each stage of the RTL and checked in with me before moving forward. When I pointed out mistakes, it could usually fix them inline in the canvas. Sometimes, I wouldn't tell it exactly what was wrong—I'd just say... it violated Rule #5 or so. And it would figure it out. A few spots needed a lot more nudging, but it didn't feel frustrating. I felt like I was working with a sharp new college grad—quick at grasping, just needs a bit of direction... The final RTL wasn't bad. Pretty close to something I'd write. With a few tweaks (which I had to do), it was functional. Yes, I spent 10x more time teaching the LLM than coding it myself. But honestly, I love teaching. And in this case, the "someone" I was teaching happens to be a multi-billion parameter model. The satisfaction of elevating it from a buggy RTL generator to a competent design assistant? Priceless! Btw, it made a bold claim that it has fused my teachings into its memory, promising to apply this wisdom in my future sessions. We'll see... I'm giving it a week or two break to settle before I hit it with a new challenge. If it asks me "What's a pipeline hazard?" again, I'm pulling the plug… #openAI

266

18 Comments

💡 AI doesn’t just change how code is written – it changes expectations and outcomes. In the final section of Jellyfish’s AI Adoption Guide, we explore how expectations for engineering leaders are evolving as AI becomes embedded across the SDLC. Because the organizations pulling ahead are treating AI as a transformation, not a tooling upgrade. Inside, you’ll explore: - Why AI adoption is quickly becoming a leadership mandate, not an option - How to balance ambitious goals with realistic expectations - What cultural investments are required to sustain long-term gains - How data can be used to align executives and engineering teams The teams that win in the AI era won’t just have better tools – they’ll have leaders who know how to guide change. Download today: https://lnkd.in/dut_6WpQ

20

Minimizing the dependencies of distributed systems, especially the fundamental building blocks, is one of the hardest but most crucial aspects of system design. It’s too easy to end up with cycles, typically transitive dependencies three or more nodes deep.

4

1 Comment

I had a chance to sit down with Daniel Ciocîrlan for his Rock The JVM podcast recently, and the episode is now up: https://lnkd.in/eSBvzJeJ We had a chance to talk about a range of topics, including experiences of being a consultant, sociotechnical systems, the pressure AI-assisted software delivery is putting on the PR process, and I even find time to talk about why trunk-based development is still the way to go!

14

1 Comment

Google Changed RAG with NEW Gemini File Search Tool (RAG Made Simple) 5 Days Ago, Google Took a Big Step Forward in the RAG Ecosystem Google has launched the File Search Tool, a fully managed Retrieval-Augmented Generation (RAG) system built directly into the Gemini API. This new capability abstracts away the complexity of retrieval pipelines, offering a simple, scalable, and developer-friendly way to ground Gemini models with your own data. Key Highlights: 1. Fully managed RAG system: No need to build or maintain custom retrievers or vector stores. 2. Integrated & scalable: Works seamlessly within the Gemini API. 3. Improved grounding: Delivers responses that are more accurate, relevant, and verifiable. 4. Cost-efficient billing: Embedding generation at query time is free; you only pay for initial file indexing at $0.15 per 1M tokens. This launch marks a major leap toward making enterprise-grade RAG systems accessible to all developers, empowering teams to build intelligent, data-grounded applications faster with precision and transparency. #GenAI #GoogleAI #Gemini #RAG #AIInnovation #LLMs #AIEngineering #GeminiFileSearchTool

7

💪 I am extremely proud of the speed that we improve Build Hub. The self-serve trial is live, powered by our new Github App integration that uses webhooks to serve GHA jobs with the best M4 Pro macOS and AMD EPYC Zen5 Linux machine types, plus 100 GB co-located cache.

10

1 Comment

𝗛𝗼𝘁 𝘁𝗮𝗸𝗲: 𝗧𝗵𝗲 𝗯𝗶𝗴𝗴𝗲𝘀𝘁 𝗿𝗶𝘀𝗸 𝘄𝗶𝘁𝗵 𝗔𝗜 𝗰𝗼𝗱𝗶𝗻𝗴 𝗿𝗶𝗴𝗵𝘁 𝗻𝗼𝘄 𝗶𝘀𝗻’𝘁 𝗱𝗮𝘁𝗮 𝗹𝗲𝗮𝗸𝘀. 𝗜𝘁’𝘀 𝗱𝗿𝗮𝗴. Teams wrap code-gen in layers of policies, approvals, and reviews… until nothing actually ships. And then the real leak shows up - work moves to shadow tools, context gets lost, and the week disappears into “processes”. If you have the basics in place - private models, sane logging, no pasting prod - more paperwork won’t save you. Velocity will! So ship the mundane work. Make one action work end-to-end. Iterate. And ship again. Keep the loop tight, and the language human. Then measure the time to feedback, not the length of your checklist. The teams that win aren’t the ones with the strictest policies. They’re the ones who turn ideas into working versions fast, learn in the open, and keep moving. If AI adoption in your team feels stuck, it might be a mindset problem - so make sure to reconsider your perspectives.

17