João Pedro Ramires Esteves jpramires

name: tufte-viz description: | Ideate and critique data visualizations using Edward Tufte's principles from "The Visual Display of Quantitative Information." Use this skill when: (1) Designing new data visualizations or charts (2) Critiquing or improving existing visualizations (3) Reviewing dashboards or reports for graphical integrity (4) Deciding between visualization approaches (5) Reducing chartjunk or improving data-ink ratio (6) Planning small multiples or high-density displays

Axios npm Supply Chain Compromise — Full Analysis Package

Date: 2026-03-31 | Attribution: BlueNoroff / Lazarus Group (HIGH confidence) Attack: Maintainer account hijacked, cross-platform RAT deployed via axios@1.14.1 and axios@0.30.4

What happened

On March 30-31, 2026, the npm package axios (~83M weekly downloads) was compromised through a maintainer account hijack. Two malicious versions injected plain-crypto-js@4.2.1, an obfuscated dropper that deploys platform-specific RATs (Windows PowerShell, macOS Mach-O C++, Linux Python). The macOS RAT is classified as NukeSped (Lazarus-exclusive). The internal project name macWebT links directly to BlueNoroff's documented RustBucket webT module from 2023.

File Index

Note

I’ve written a newer optimized 2026 version of this guide with a faster setup using Zinit + Starship and improved plugin loading.

This version avoids slow shell startups and works better with modern Zsh setups.

Updated guide: https://gist.github.com/n1snt/2cccc8aa5f7b645a7628d3512c70deb6

Oh my zsh.

People

`:bowtie:`	😄 `:smile:`	😆 `:laughing:`
😊 `:blush:`	😃 `:smiley:`	☺️ `:relaxed:`
😏 `:smirk:`	😍 `:heart_eyes:`	😘 `:kissing_heart:`
😚 `:kissing_closed_eyes:`	😳 `:flushed:`	😌 `:relieved:`
😆 `:satisfied:`	😁 `:grin:`	😉 `:wink:`
😜 `:stuck_out_tongue_winking_eye:`	😝 `:stuck_out_tongue_closed_eyes:`	😀 `:grinning:`
😗 `:kissing:`	😙 `:kissing_smiling_eyes:`	😛 `:stuck_out_tongue:`

	#!/bin/bash

	## Create the response FIFO
	rm -f response
	mkfifo response

	function handle_GET_home() {
	RESPONSE=$(cat home.html \| \
	sed "s/{{$COOKIE_NAME}}/$COOKIE_VALUE/")
	}

	#include <stdio.h>

	/*
	* Calculates what Ada Lovelace labeled "B7", which today we would call the 8th
	* Bernoulli number.
	*/
	int main(int argc, char* argv[])
	{
	// ------------------------------------------------------------------------
	// Data

	// How many ways can you alert(document.domain)?
	// Comment with more ways and I'll add them :)
	// I already know about the JSFuck way, but it's too long to add (:

	// Direct invocation
	alert(document.domain);
	(alert)(document.domain);
	al\u0065rt(document.domain);
	al\u{65}rt(document.domain);
	window['alert'](document.domain);

	/* NOTICE: THIS WAS MADE BACK IN 2017, OF COURSE IT'S NOT GOING TO WORK WELL NOW THAT TWITTER'S FUCKED THINGS UP */
	@namespace url(http://www.w3.org/1999/xhtml);

	@-moz-document domain("twitter.com") {
	[data-component-context="suggest_recap"],
	[data-component-context="suggest_who_to_follow"],
	[data-component-context="suggest_activity"],
	[data-component-context="suggest_activity_tweet"],
	[data-component-context="suggest_recycled_tweet_inline"],
	[data-component-context="suggest_recycled_tweet"]{