DEV Community: James Kareem

The update button is part of your attack surface

James Kareem — Fri, 23 Oct 2026 00:11:43 +0000

For about six months in 2025, the servers that delivered Notepad++ updates weren't entirely in the maintainer's hands. The editor's code was fine. The pipe it travelled down wasn't.

That's what makes supply chain attacks so annoying. Nothing you wrote was wrong, nothing you scanned looked odd, and the "new version available" prompt is one you've clicked a hundred times. Notepad++ disclosed the compromise on February 2, 2026, and researchers attributed the activity to a Chinese state-linked group called Lotus Blossom. Around the same time, EmEditor's official download site was compromised to push infostealer malware. Two popular editors, a similar trick.

You can't out-careful this by getting better at spotting phishing. What helps is making your own setup a little less trusting of whatever arrives through the usual channels, and three habits get you most of the way.

First, pin your build steps to a commit instead of a tag. Tags can be moved after the fact. A full commit SHA can't.

yaml

uses: actions/checkout@v4 # a tag can be re-pointed under you
uses: actions/checkout@PASTE_COMMIT_SHA # a full commit SHA can't

Second, check installers against a hash you got from somewhere else. If the checksum sits on the same page as the download, a compromised host can swap both.

powershell
Get-FileHash .\installer.exe -Algorithm SHA256
bash
sha256sum installer.deb

Third, let someone else update first. Run dev tooling updates on a throwaway machine, or just wait a few days, so security researchers have time to flag a bad release before it reaches your laptop.

One more, because it's the newest way to get burned: if an AI assistant tells you to pip install or npm install a package you've never heard of, look it up before you run it. Attackers register the names that models tend to invent, which people now call slopsquatting.

We wrote up the wider picture, from Notepad++ to deepfake phishing, on Vaudacia. See Details

Deepfake Detection Is Measuring the Wrong Thing

James Kareem — Sat, 17 Oct 2026 21:08:37 +0000

Detectors ace the benchmarks their makers build and miss three in ten calls in the field. The fix isn't a better model.

Meta's Muse Wonder Bet: Memory Beats Benchmarks

James Kareem — Tue, 13 Oct 2026 16:52:18 +0000

Meta's first frontier models ship with a memory layer and a cached-token price that reveals where the real cost of an agent sits.

AI Made You 10% Faster. The 10x Hides in Your Workflow

James Kareem — Thu, 08 Oct 2026 16:20:16 +0000

Most teams get 10 percent from AI, not 10x. The difference is where the state of the work lives, not which model you bought.

The Boring Company's $3B Says Less Than It Looks

James Kareem — Fri, 25 Sep 2026 14:33:14 +0000

A UAE-led $3bn tunnel round is being read as proof that patient capital is back. The deal structure points somewhere narrower.

The iPhone Duo Hinges on Samsung, Not Siri

James Kareem — Wed, 23 Sep 2026 14:11:48 +0000

Apple's first foldable is a $1,999 engineering problem, and the hardest part is a sheet of glass made by its biggest rival.

Your Micro-SaaS Niche Is Too Cheap, Not Too Small

James Kareem — Sun, 20 Sep 2026 13:33:14 +0000

Only 6.1% of solo-built software clears $10K a month. The gap isn't market size, it's what customers already pay to cope.

The Commute Is the Wrong Place to Fight $108 Oil

James Kareem — Sat, 19 Sep 2026 13:02:42 +0000

Brent is above $108 and households are cutting drives to cope. The numbers say the pump was never the biggest lever.