kenn

SHA1-hulud Supply Chain Attack Scanner

A bash script to detect indicators of compromise from the SHA1-hulud npm supply chain attack.

Background

SHA1-hulud is a supply chain attack targeting npm packages discovered in late 2025. Attackers compromise legitimate npm maintainer accounts and publish malicious versions that execute code during npm install.

Reference: https://thehackernews.com/2025/11/second-sha1-hulud-wave-affects-25000.html

kenn

Local Domains for Development

tl;dr

Install dnsmasq to make all .test domains point to localhost on your Mac.

Why and how to set up .test domain on your Mac

When we work on a local machine for development, we usually point to localhost:3000 in the browser. But using that domain for everything comes with some downsides when you work on multiple projects.

kenn

import { useRevalidator } from '@remix-run/react'
import { useEffect } from 'react'

// Rendering will ensure all page loaders are revalidated according to a given
// frequency
export const Poller = ({ seconds }) => {
  usePolling(seconds)

  return null
}

kenn

def scroll_merge(klass, source_names, target_name, batch_size = 100):
    Qdrant.recreate(target_name) # reset target collection

    def generator(source_name):
        offset = None

        while True:
            # Scroll https://qdrant.tech/documentation/points/#scroll-points
            # https://github.com/qdrant/qdrant-client/blob/master/qdrant_client/qdrant_client.py#L412
            result = Qdrant.client.scroll(

kenn

199.91.171.93 bb-m.rubygems.org
54.186.104.15 api.rubygems.org rubygems.org

kenn

require Rails.root.join('config/environments/production')
 
MyApp::Application.configure do
  config.action_dispatch.tld_length = 2 # domain.com vs staging.domain.com
end

kenn

#pragma mark - Original

- (NSURLSessionDataTask *)GET:(NSString *)URLString
                   parameters:(id)parameters
                      success:(void (^)(NSURLSessionDataTask *task, id responseObject))success
                      failure:(void (^)(NSURLSessionDataTask *task, NSError *error))failure;

#pragma mark - Overrides

- (NSURLSessionDataTask *)GET:(NSString *)URLString

kenn

# cat auth.log | grep Failed | grep root | cut -d ' ' -f 11 | sort | uniq
111.74.238.101
111.74.238.103
111.74.238.104
111.74.238.124
111.74.238.138
111.74.238.151
111.74.238.152
111.74.238.153
111.74.238.167

kenn

mysql> explain SELECT * FROM messages USE INDEX (index_messages_on_friend_id_and_id) WHERE friend_id = 100 AND (id < 1000000) ORDER BY id DESC LIMIT 10\G
*************************** 1. row ***************************
id: 1
select_type: SIMPLE
table: messages
type: range
possible_keys: index_messages_on_friend_id_and_id
key: index_messages_on_friend_id_and_id
key_len: 8
ref: NULL

kenn

# config/initializers/doorkeeper.rb
Doorkeeper.configure do
  client_credentials :from_obfuscated_params
end

module Doorkeeper
  module OAuth
    class Client
      module Methods
        def from_obfuscated_params(request)