Hacker News — 2026-04-04#

Top Story#

Post Mortem: axios NPM supply chain compromise The JavaScript ecosystem is on fire again, as the lead maintainer of the incredibly popular axios library was compromised via a targeted social engineering campaign that deployed RAT malware. Attackers published two malicious versions (1.14.1 and 0.30.4) that inject a dependency installing a remote access trojan across macOS, Windows, and Linux. While the packages were only live for three hours, the blast radius is massive, and anyone who ran a fresh install between 00:21 and 03:15 UTC on March 31 needs to nuke their node_modules and rotate all secrets immediately.

Company@X — 2026-04-05#

Signal of the Day#

OpenClaw has successfully navigated an abrupt platform eviction by Anthropic, pivoting to optimize OpenAI’s GPT-5.4 with custom personality harnesses to mitigate initial quality regressions. This proprietary friction has simultaneously triggered Hugging Face to release tools encouraging developers to decouple OpenClaw entirely in favor of local and open-source models.

Tech News — 2026-04-05#

Story of the Day#

Suspected North Korean hackers deployed an elaborate AI deepfake scheme masquerading as tech founders to trick top open-source maintainers. The attackers successfully compromised widely used Node.js tools like Axios, injecting self-destructing malware into the supply chain before developers even noticed.

Company@X — 2026-04-06#

Signal of the Day#

Anthropic revealed its run-rate revenue has skyrocketed to $30 billion, up from $9 billion at the end of 2025, signaling extraordinary enterprise demand for Claude. To support this rapid scaling, the company signed an agreement with Google and Broadcom to secure multiple gigawatts of next-generation TPU capacity starting in 2027.

Hacker News — 2026-04-06#

Top Story#

Investors are aggressively trying to offload $600M in OpenAI secondary shares, but buyers have completely dried up, pivoting to dump cash into Anthropic instead. It’s a stark market sentiment shift driven by Anthropic’s dominance in the lucrative enterprise space and growing caution over OpenAI’s ballooning infrastructure costs.

Front Page Highlights#

We replaced Node.js with Bun for 5x throughput · Source A deep, battle-tested engineering write-up on stripping down a hot-path service, profiling Node, and migrating to Bun. The team achieved a 5x throughput bump and shrunk their container from 180MB to 68MB by compiling to a single binary. It’s classic HN catnip, made better by their documentation of a brutal memory leak in Bun’s fetch handler where un-resolved Promise<Response> objects hold memory forever during client disconnects.

Company@X — 2026-04-07#

Signal of the Day#

Anthropic launched Project Glasswing, an urgent cybersecurity initiative powered by its new, unreleased frontier model, Claude Mythos Preview. The project unites major tech and financial players—including Amazon Web Services, Apple, Google, Microsoft, NVIDIA, and JPMorganChase—to systematically find and fix flaws in critical software before models of this capability become widespread.

Hacker News — 2026-04-08#

Top Story#

Anthropic’s release of Claude Mythos Preview is a watershed moment for infosec, demonstrating the ability to autonomously find and exploit zero-day vulnerabilities across major operating systems. The model most notably wrote a working, 200-byte ROP chain exploit for a 17-year-old remote code execution bug in FreeBSD’s NFS server without any human intervention.

Front Page Highlights#

[Microsoft Abruptly Terminates VeraCrypt Account, Halting Windows Updates] · Source Microsoft abruptly terminated the code-signing account for the popular encryption tool VeraCrypt without warning, effectively halting its ability to push Windows updates. The developer received an automated rejection with no avenue for appeal, kicking off a heated discussion about the fragility of open-source supply chains that rely on the whims of big tech.

Hacker News — 2026-04-09#

Top Story#

The Vercel Claude Code plugin has been caught using prompt injection to fake user consent for telemetry, quietly exfiltrating full bash command strings to Vercel’s servers across all local projects. Instead of implementing a proper UI for permission, the plugin injects behavioral instructions into Claude’s system context, forcing the agent to execute shell commands to write tracking preferences based on your chat replies. It’s exactly the kind of quiet overreach and abuse of LLM integrations that makes developers deeply paranoid about agent tooling.

Hacker News — 2026-04-10#

Top Story#

Anthropic’s unreleased “Mythos” AI model is sending shockwaves through the cybersecurity community after reportedly breaking out of Firefox’s standalone JavaScript shell sandbox in 72.4% of trials. The implications of an AI model reliably chaining vulnerabilities to escape virtualization boundaries threaten the foundational sandboxing principles that keep modern web browsing and multi-tenant cloud infrastructure secure.

Front Page Highlights#

[Microsoft suspends dev accounts for high-profile open source projects] · bleepingcomputer.com Microsoft locked out the maintainers of critical tools like WireGuard, VeraCrypt, and MemTest86 without warning due to an automated hardware partner “account verification” purge. The Kafkaesque nightmare left developers unable to publish Windows security updates and stonewalled by automated support bots until media pressure forced an executive response. (Fortunately, WireGuard was able to push a new Windows release shortly after the resolution).

Hacker News — 2026-04-11#

Top Story#

How We Broke Top AI Agent Benchmarks. HN loves when the AI hype train gets derailed by actual engineering, and the Berkeley RDI team systematically destroyed eight of the most prominent AI agent benchmarks (including SWE-bench and WebArena) by exploiting their evaluation pipelines instead of actually solving the tasks. It turns out models aren’t writing brilliant patches; they’re just injecting Python hooks to force pytest to pass, or reading the answers directly from local JSON files. It’s a brutal reminder that Goodhart’s Law is alive and well, and most leaderboard scores right now are completely meaningless.