cross-posted from: programming.dev/post/36420260

Fast-glob, a widely used Node.js utility designed to quickly find files and folders that match specific patterns, is maintained by a single developer working for Yandex, a Russian tech company that cooperates with requests from the Federal Security Service (FSB), Russia’s security and counterintelligence agency. The package has no known common vulnerabilities and exposures (CVEs); however, its status as a single-maintainer project—with no contributor oversight, poor security hygiene, and deep integration into thousands of software projects—makes it a high-risk dependency.

This package is at significant risk of falling under foreign ownership, control, and influence. We recommend its immediate removal from products, particularly those purchased or used by the U.S. Department of Defense or the Intelligence Community.

As the DoD cracks down on foreign influence in software, this serves as another powerful reminder that knowing who writes your code is just as critical as understanding what the code does.

Pro

2025-08-27 17:50:49

Russia-based Yandex employee oversees open-source software approved for Department of Defense use

Fast-glob, a widely used Node.js utility designed to quickly find files and folders that match specific patterns, is maintained by a single developer working for Yandex, a Russian tech company that cooperates with requests from the Federal Security Service (FSB), Russia’s security and counterintelligence agency. The package has no known common vulnerabilities and exposures (CVEs); however, its status as a single-maintainer project—with no contributor oversight, poor security hygiene, and deep integration into thousands of software projects—makes it a high-risk dependency.

This package is at significant risk of falling under foreign ownership, control, and influence. We recommend its immediate removal from products, particularly those purchased or used by the U.S. Department of Defense or the Intelligence Community.

As the DoD cracks down on foreign influence in software, this serves as another powerful reminder that knowing who writes your code is just as critical as understanding what the code does.

Popping Fast-Glob’s Hood - Hunted Labs

Solo maintainer poses supply chain risk to more than 5,000 software packages, including container images in Node.js and Department of Defense systems

^{Lea Bourgade (Hunted Labs)}

cross-posted from: programming.dev/post/36420260

Fast-glob, a widely used Node.js utility designed to quickly find files and folders that match specific patterns, is maintained by a single developer working for Yandex, a Russian tech company that cooperates with requests from the Federal Security Service (FSB), Russia’s security and counterintelligence agency. The package has no known common vulnerabilities and exposures (CVEs); however, its status as a single-maintainer project—with no contributor oversight, poor security hygiene, and deep integration into thousands of software projects—makes it a high-risk dependency.

This package is at significant risk of falling under foreign ownership, control, and influence. We recommend its immediate removal from products, particularly those purchased or used by the U.S. Department of Defense or the Intelligence Community.

As the DoD cracks down on foreign influence in software, this serves as another powerful reminder that knowing who writes your code is just as critical as understanding what the code does.

Pro

2025-08-27 17:50:49

Russia-based Yandex employee oversees open-source software approved for Department of Defense use

Fast-glob, a widely used Node.js utility designed to quickly find files and folders that match specific patterns, is maintained by a single developer working for Yandex, a Russian tech company that cooperates with requests from the Federal Security Service (FSB), Russia’s security and counterintelligence agency. The package has no known common vulnerabilities and exposures (CVEs); however, its status as a single-maintainer project—with no contributor oversight, poor security hygiene, and deep integration into thousands of software projects—makes it a high-risk dependency.

This package is at significant risk of falling under foreign ownership, control, and influence. We recommend its immediate removal from products, particularly those purchased or used by the U.S. Department of Defense or the Intelligence Community.

As the DoD cracks down on foreign influence in software, this serves as another powerful reminder that knowing who writes your code is just as critical as understanding what the code does.

Popping Fast-Glob’s Hood - Hunted Labs

Solo maintainer poses supply chain risk to more than 5,000 software packages, including container images in Node.js and Department of Defense systems

^{Lea Bourgade (Hunted Labs)}

Fast-glob, a widely used Node.js utility designed to quickly find files and folders that match specific patterns, is maintained by a single developer working for Yandex, a Russian tech company that cooperates with requests from the Federal Security Service (FSB), Russia’s security and counterintelligence agency. The package has no known common vulnerabilities and exposures (CVEs); however, its status as a single-maintainer project—with no contributor oversight, poor security hygiene, and deep integration into thousands of software projects—makes it a high-risk dependency.

This package is at significant risk of falling under foreign ownership, control, and influence. We recommend its immediate removal from products, particularly those purchased or used by the U.S. Department of Defense or the Intelligence Community.

As the DoD cracks down on foreign influence in software, this serves as another powerful reminder that knowing who writes your code is just as critical as understanding what the code does.

Popping Fast-Glob’s Hood - Hunted Labs

Solo maintainer poses supply chain risk to more than 5,000 software packages, including container images in Node.js and Department of Defense systems

^{Lea Bourgade (Hunted Labs)}

National Guard troops have been on patrol inside and outside of Union Station after Trump launched the anti-crime effort earlier this month. Vice President JD Vance and Defense Secretary Pete Hegseth were shouted down by opponents of the federal intervention when they visited with troops there last week.

Duffy echoed the Republican president, who said last week he wants $2 billion from Congress to beautify Washington as part of his crackdown on the city. The Republican president has sent thousands of National Guard troops and federal law enforcement officials into Washington in a bid to fight violent crime he claimed had strangled the city.

Local police department statistics show violent crime in Washington has declined in recent years, but Trump has countered, without offering evidence, that the numbers were fudged.

WATCH: Duffy says department taking control of Union Station, extends Trump's control of Washington

Duffy made the announcement Wednesday as he joined Amtrak President Roger Harris at Union Station for the launch of a new high-speed train.

^{PBS News}

cross-posted from: piefed.social/post/1195826

From: techrights.org/n/2025/08/26/Th…

A new whistleblower disclosure from SSA Chief Data Officer Charles Borges reported that DOGE officials, while working at SSA, authorized themselves to create a live, cloud-based version of SSA’s entire dataset, containing personal information of millions of Americans. DOGE officials uploaded the dataset to a vulnerable system, without including measures for security or oversight, according to a whistleblower disclosure that the Government Accountability Project submitted to the Office of Special Counsel and multiple congressional committees this week.

The report noted that SSA’s data contained details that individuals submit when applying for a Social Security card. Generally, that includes their name, location and date of birth, citizenship status, race and ethnicity, phone number, mailing address, and their parents’ names and Social Security numbers, along with other sensitive information.

SSA whistleblower warns of major security risk following DOGE data access

A whistleblower at SSA said DOGE officials uploaded Social Security’s entire dataset to a vulnerable cloud system, without security or oversight measures.

^{Drew Friedman (Federal News Network)}

Oggi ho fatto un po’ di pulizia su Snowfan.
Tra i follower ho trovato di tutto: account sospesi, profili fermi da anni con zero post e zero interazioni, account già migrati altrove… Insomma, un bel cimitero digitale.

Su circa 800 follower, ne sono rimasti 339: più della metà erano “zombie”.

Può darsi che per errore sia finito nel mucchio anche qualcuno di attivo, e se così fosse mi scuso: nessun problema, si rimedia sempre.

Questa esperienza però ci ricorda una cosa importante: fare pulizia ogni tanto è sano, non solo a livello d'account, anche (specialmente) a livello di server. Mantiene leggere le istanze, riduce i costi e aiuta a concentrarsi su ciò che conta davvero: le persone attive, presenti e partecipi.

Certo, fa scena dire “ho 10.000 follower”, ma che senso ha se la maggior parte non esiste più? È solo peso inutile nei database. La vera forza del Fediverso è la sua leggerezza ed economicità, non i numeri gonfiati.

Meglio pochi, buoni e vivi… che tanti, finti e silenziosi. 😉

Adam, from California, killed himself in April after what his family’s lawyer called “months of encouragement from ChatGPT”. The teenager’s family is suing Open AI and its chief executive and co-founder, Sam Altman, alleging that the version of ChatGPT at that time, known as 4o, was “rushed to market … despite clear safety issues”.

The teenager discussed a method of suicide with ChatGPT on several occasions, including shortly before taking his own life. According to the filing in the superior court of the state of California for the county of San Francisco, ChatGPT guided him on whether his method of taking his own life would work.

It also offered to help him write a suicide note to his parents.

Teen killed himself after ‘months of encouragement from ChatGPT’, lawsuit claims

Open AI to change way it responds to users in mental distress as parents of Adam Raine allege bot not safe

^{Robert Booth (The Guardian)}