Hackers Pull Off The Biggest NPM Hack Ever... To Steal $0.22

So hackers managed to pull the biggest supply chain chain hack ever in history, but they stole only 22 cents. That That's a big fail. Well, on both sides. Both sides failed. So you want to I mean, we're being facitious. There's more to this story obviously, but um a major open- source maintainer of some major MPM packages was caught off guard by a fishing email that gained access to his MPM account or whatever. And these these hackers were then able to access all of these packages and insert I guess some sort of command that says that changed the URL of the of some sort of donation thing. Yes. So imagine uh you you open your MetaMask crypto wallet and then you want to send um any amount of crypto to somebody else. So what this tool would do it would find out like that you have like this is your crypto address and then it would like the this the receiver and it would change it to their owns and they would use a specific algorithm. That's how I understand that would minimize the amount of change so you wouldn't notice. So it's kind of like use the closest words uh and so you wouldn't notice that the the the address changed. And that way the idea was that theoretically like they could any crypto sent to anybody uh that they would receive it. They would amount. Got it. Was like five cents and then another. So the issue is is with all of this and the reason why they were only to steal 22 cents is that a lot of the packages that they hacked were backend packages. So if this was a extension or if this is a front this is a front end uh compromise or intended to be a sort of front end thing they were only able to change only a few and again was only able to steal 22 cents. So it's a complete failure from from that perspective. I mean, it was solved and and removed within eight hours, you know. It was it was I mean, still a long time, you know. Um I woke up eight hours later to a 1510 Google Vertex AI bill this morning and it went up to 15 because I couldn't bloody delete it. So, a lot can happen in eight hours, not more than 22 cents. Anyway, but I think this just raises into the question of just fishing and how si sophisticated yet simple some of these emails can be. When I read this, I was immediately reminded that I've I've clicked on recently and it just it just needs to be the right place at the right time. I clicked on a link in a docu sign email saying I need to sign a document and um it was on a day that I was indeed waiting for some sort of document signature. So I clicked on it and then it took me through to an Apple login and I was like Apple login and I was sort of my mouse was moving. I was clicking around and I was going to do what it asked me to do and then I was like this ain't right at all. And I looked at the email and I looked at the URL and did all the usual stuff I do and it's like whoa. as a smart, handsome, funny, intelligent person like myself, even I can get done with fishing. Yeah. You know, and so I think they're finding ways to uh to to get us and it's becoming more and more sophisticated and I think we all just need to have a bit more due diligence and whatever. But Yan's [ __ ] the as a reminder just don't click on any any link even if you recognize the link. So I read a tweet that because this was only made aware to me by Theo, right? Uh and it's now in this moment just reminded me of a tweet that he retweeted. So Mr. Beast had this charity event organization where you put in so much money and they're going to do a bunch of stuff in Africa, right? Some really really cool stuff. And this guy, this millionaire, he was a casino, so he kind of freaking deserved it to be fair. He's a casino game maker. And he donated. And then shortly after he donated, he received a a a telegram message to say, "Thanks, guys. This is a new group that I've from Mr. Beast. This is a new group I've created uh for the top donors, and we want you to um Wow. We've just we've got a Coinbase thing going on. One of the sponsors of the video, Coinbase, wants you to put more money into the Coinbase uh coin that they're releasing and you get, which by the way is insider trading, which is totally legal. So, this dumbass multi-millionaire was was glorifying his willingness to participate into insider trading, followed along with it, and then he donated an extra [ __ ] quarter of a million or something crazy. Um, and then it was like, "Right, this is the last round of funding. Like, get into this. Mr. Beast is like, get in on this." And then he's seeing tweets from other donators of Mr. Beast like uh what's that Mark guy? Mark uh I don't know but he Mark Ro uh Mark Ro Yeah. Yeah. Uh the the NASA the exNASA engineer. He he's messaging as well in the group and whatever getting all hyped up and whatever kind of messages again. He calls Mr. Beast because he's like you know after his second donation by the way he decides to call Mr. Beast and Mr. Beast is like, "What group? What group are you talking about?" And he's like, "You're kidding." And he's like, "No, there's no other group. There's like, no, there's nothing going on." So, yeah. And and you know, so he's talking this story. Yeah. I got the same message, right? I got the same not the same message, sorry, but the same format. He screenshotted the message in his tweet. The amount of grammatical errors, just everything about this tweet is so like obviously a scam. And this stupid dumbass multi-millionaire crypto, not even crypto, but casino guy totally fell for it. And he got slated in the comments because it's like, oh my god, I have no sympathy for you because you fell for dumb [ __ ] like that. Anyway, that's my story. Well, I didn't know about it, but yeah, the scams are getting out of hand. And I I don't know like having it's so easy to not have grammatical error in writing because you know a it's crazy that still and it was like that by the way in back in the days with websites, right? If you would see a website and the website had grammatical error, you would say I'm not going to buy from them because they are scamming me. Yeah. And now people are falling for the same [ __ ] It's just in a different It's crazy. Uh, so I get my AI to write a lot of my posts on LinkedIn and stuff like that. I'm still I don't use any AI for Twitter, but like LinkedIn, I get it to put in a typo. I say add at least I I say choose to add a typo or not. Just at your discretion, add a typo. Well, what I do when I write something, I write it and then I ask AI to fix it and then I break it again before sending it. So, I do like actually get into it and I delete like whatever I feel like it's it's too uh unhuman, too perfect. I just make it how I say it. And I think that is beautiful. This is part of a larger conversation on my show, Command AI, which we stream live every single week. We discuss the news and all things related to AI in the world of design and web.