Thompson EdoloEngineering notes on agent workflows, infrastructure and shipping.https://thompsonedolo.com/A fake take-home hid an RCE, and npm's takedown was what saved mehttps://thompsonedolo.com/posts/fake-recruiter-supply-chain-attack/https://thompsonedolo.com/posts/fake-recruiter-supply-chain-attack/A fake recruiter's take-home repo hid a build-time RCE in postcss.config.js — npm's own takedown of the payload package is the only reason it didn't run.Thu, 20 Aug 2026 00:00:00 GMT