The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one
THE SO WHAT
A credential-stealing worm shipped through a library served ~127 million times a week shows that “trusted maintainer” is now a prime attack surface. If you ship on Node or similar ecosystems, lock down your dependency tree and treat maintainer account security as part of your own security posture.
READ THE SOURCE
MORE FROM THE WIRE
Deep & Emerging TechMysk: Apple's Private Relay tool can leak users' IP addresses due to issues in Apple's WebKit browser engine, also affecting OnionBrowser, a Tor browser for iOS
If WebKit bugs mean Private Relay and even Tor-based OnionBrowser can leak real IPs, you can’t treat Apple’s privacy stack as a hard guarantee. For any sensitive workflows — investigations, competitive research, dissident or journalist comms — assume mobile browsing needs independent verification and layered network protections, not just OS features.
Deep & Emerging Tech‘Our corrupt, AI-addicted President cannot be allowed to sacrifice our federal lands’: A bill to permanently ban AI data centers from federal lands has been introduced to Congress
A bill to permanently ban AI data centers on federal lands shows data center siting is now a frontline political and environmental issue, not just a zoning problem. If you’re planning large-scale AI infra, you need a parallel strategy for local politics and environmental optics — not just power, water, and fiber modeling.
Deep & Emerging TechGPU prices are approaching 2.5x their launch cost. Asus and Gigabyte just made it official with a second 2026 price hike.
Channel hikes pushing some GPUs to ~2.5x launch prices — with RTX 5090D V2 up another $592–$666 — mean your AI infra budget is now exposed to component inflation, not just cloud rates. Lock in multi-year pricing where you can, and revisit the build-vs-rent calculus for any workload that assumed stable GPU capex.
Deep & Emerging TechThe US wants Chinese optics out of its AI data centres. Amazon and Microsoft pay first.
An FCC move to halt imports of Chinese optical transceivers — already hitting Zhongji Innolight and Eoptolink stocks — turns AI data center optics into a national security supply chain. Hyperscalers and large AI users should expect higher networking costs, multi-sourcing requirements, and potential deployment delays as US-compliant optical capacity ramps.