🦥A VS Code extension hacked GitHub

Hello beautiful people,

Welcome to another terrible edition of Sloth Bytes. I hope you had a great week and drank lots of caffeine.

You know the fix: longer prompts, more context, clearer constraints. But typing all that takes five minutes per prompt, so you shortcut it. Every time.

Wispr Flow lets you speak your prompts instead of typing them. Talk through your thinking naturally — include context, constraints, examples — and get clean text ready to paste. No filler words. No cleanup.

Works inside ChatGPT, Claude, Cursor, Windsurf, and every other AI tool. System-level, so there's nothing to install per app. Tap and talk.

Millions of users worldwide. Teams at OpenAI, Vercel, and Clay use Flow daily. Free on Mac, Windows, and iPhone.

Try Wispr Flow free

Is your growth in-line with your peers in B2B SaaS & AI? 

Benchmark yourself against actual billings data for Maxio’s 2000+ global customers.

Key takeaways from the report: 

Download the Report

Between the security chaos this week, you might have missed Google's biggest developer keynote in years. Here's what actually matters.

Google announced Antigravity 2.0 - Google’s version of Claude Code and Codex. It’s a standalone desktop app built entirely around agent orchestration, alongside a new CLI, an SDK, Managed Agents in the Gemini API, and enterprise support through the Gemini Enterprise Agent Platform. You can Spin up specialized subagents for parallel workflows, with built-in terminal sandboxing and credential masking baked in. New AI Ultra tier at $100/month (5x Pro limits).

Gemini 3.5 Flash was announced - It beats Gemini 3.1 Pro on coding and agentic benchmarks while running 4x faster. The catch: it costs 3x more than the Flash model it replaces. So far developers have been very underwhelmed…

WebMCP - a proposed open standard for agents to interact with websites natively

Native Kotlin support in Google AI Studio - You can now generate Android apps from a single prompt.

Google announced a lot more, so If you want to see everything Google revealed you can check it out here.

Last week we covered TeamPCP. A threat group running a self-replicating supply chain worm called "Mini Shai-Hulud." Each wave steals credentials and uses them to break into the next target.

This week they breached GitHub and launched their biggest npm attack yet.

The GitHub breach is almost embarrassingly simple. One employee installed a poisoned VS Code extension and that single install gave TeamPCP access to roughly 3,800 of GitHub's internal repositories: platform source code, Copilot files, GitHub Actions code, infrastructure configs.

It seems they also posted in a cybercrime forum that they’re selling the data for at least $50k

GitHub confirmed the breach on twitter, and the investigation is ongoing and will be updated.

Google Cloud's automated enforcement system suspended Railway's account with zero warning.

Railway is a deployment platform that lets developers ship apps without managing infrastructure. They host around 10 million services and ALL of them went down for 8 hours because Google’s automated system suspended their account.

Now you might be thinking: Isn't that exactly the kind of thing a deployment platform is supposed to protect you from?

If Railway is managing your infrastructure, how does a cloud provider suspending Railway's account become your problem?

Fair question, They actually run their own bare metal hardware across 8 sites worldwide, with cloud platforms like AWS and GCP as additional burst capacity for when demand spikes, this makes it so they don’t depend on one provider.

Hosting wasn’t the problem though, the problem was one specific GCP dependency that handled their dashboard, API, and parts of their network infrastructure.

Railway has this feature called edge proxies, which are servers that sit in front of every customer workload and direct incoming traffic to the right destination. To do that they rely on routing tables, a live map of where every service is running. That map was hosted on GCP.

When GCP went down, the map stopped updating. The proxies kept working off their cached version for a while, but once that cache expired they had no idea where to send traffic. Every request came back as a 404. This hit every workload across GCP, AWS, and bare metal since they all route through the same proxies which is why it affected all workloads.

Railway is now working on removing GCP from any critical infrastructure path so this can never happen again.

The downfall of bug bounties - A security researcher breaks down why bug bounty programs have quietly become a broken system, and who's actually getting paid.

How Claude Code works in large codebases - Straight from Anthropic: how to actually use Claude Code on real, messy production repos.

NodeBook - A free, comprehensive guide to Node.js internals, runtime, and networking. It’s great stuff.

Nobody Pushed Back - An article describing that most system architecture problems aren’t because of lack of knowledge, but more so engineers staying silent until it's too late.

Streaming terabytes of videos for pennies - A practical walkthrough on building genuinely cheap video streaming infrastructure using Cloudflare R2. Actually useful if you're building anything with video.

Layouts.dev - A notebook-style scratchpad for building UI layouts with Tailwind and Shadcn. It’s way faster than spinning up a full project just to prototype a component.

Koodo Reader - An open-source ebook manager with cloud sync across Windows, Mac, Linux, iOS, Android, and web. Reading books in browser tabs is a crime and this fixes it.

Trees by Pierre - An open-source React file tree rendering library. Highly customizable, accessible (full ARIA support), git-status badges, keyboard navigation. Everything you'd want for building a file-browser UI.

You can view them from my instagram or tiktok.

Question for you this week: What's a programming concept you've heard a million times but still don't fully understand?

I think for me it’s actually pointers. Not sure why I suck at understanding them. Especially when I have to read code, it takes me a while to fully understand what exactly is happening.

Anyways, that’s all from me!

Have a great week, be safe, make good choices, and have fun coding.

If I made a mistake or you have any questions, feel free to comment below or reply to the email!

See you all next week.

If your company is interested in reaching an audience of developers and programming enthusiasts, you may want to advertise with us here.