Podbit · The a16z Show
Truffle Security found roughly 250,000 live API keys embedded in training datasets on Hugging Face. One of those keys had push access to a foundational Linux library — meaning malware could have been delivered to most machines on the planet. The discovery wasn't theoretical.
Where this was said
At 17:40 · chapter starts 16:01
Feross offers the most concrete near-term fix on the table: npm's planned 2FA requirement would make the worm's self-propagation mechanism impossible, since no automated publish could happen without a human interactively confirming. He believes it's the right call. But the disruption will be enormous — virtually every CI/CD pipeline that auto-publishes packages will break overnight. And the harder problem remains: npm has the backing of GitHub and Microsoft. Most of the critical registries the world depends on are run by volunteers on donated time, without security teams or enterprise SLAs. These registries won't make similar changes because they can't. Feross illustrates the human dimension with a story: a prolific npm maintainer he knew personally was running a six-letter password, not out of negligence but out of a genuine cultural worldview that the internet should be a high-trust place. That is the population defending the world's software infrastructure. [1] — Feross Aboukhadijeh "npm plans to require interactive human 2FA confirmation before any new package publishes starting January 2027. This would effectively end …" 16:01 [2] — Feross Aboukhadijeh "The world's most critical software infrastructure is maintained by volunteers who have no security teams, no SLAs, and often no security tr…" 17:20
npm has announced plans to require interactive 2FA confirmation before any new package publishes, which would effectively kill npm worms but disrupt existing automation pipelines.
npm plans to require interactive human 2FA confirmation before any new package publishes starting January 2027. This would effectively end npm worms, but it will break the entire ecosystem's CI/CD automation overnight. Other volunteer-run registries won't follow, leaving them as the next target.
The world's most critical software infrastructure is maintained by volunteers who have no security teams, no SLAs, and often no security training. Feross Aboukhadijeh recounted a prolific npm maintainer running a 6-letter password with full conviction that it was fine. Companies relying on this code need to own the vetting responsibility — and fund the people doing the work.
Truffle Security found approximately 250,000 live API keys embedded in training datasets hosted on Hugging Face, many with direct software supply chain implications.
One of the leaked Hugging Face keys had direct push access to a foundational Linux library, meaning malware could have been pushed to most machines on the planet.
Feross Aboukhadijeh argued that relatively small sponsorship amounts of $25K–$50K from enterprises could meaningfully fund security staff at under-resourced open-source package registries.
Sam had no coding knowledge, so he used ChatGPT voice mode to generate his entire codebase and copy-pasted it into Notepad. A friend later introduced him to Cursor, and he never looked back.
Copy days of Discord chat history, paste it into ChatGPT, and ask it to list recurring pain points. The ones that come up most often are your best product bets.
Sam's top advice: when prompting Cursor, tell it to architect code for 100,000 users from day one. The AI changes its approach, building scalable frameworks instead of brittle one-user code.
With AI coding tools like Cursor, Bhanu replicates an existing free tool for a new keyword in under 5 minutes. What used to be a multi-day build is now a lunch-break task.
Ahrefs, SiteGPT, Cal.com, PostHog, Datafast, Sibyl AI, Bento, Feather, Featurepace, Mintlify, Cloud Code, ChartMogul — Bhanu runs his entire business solo with these 12 tools.
PropGPT runs on React Native with TypeScript and Python for ML, Neon for the database, RevenueCat and Superwall for monetization. LLM costs are $20/month, data APIs $100/month, and after $10K in monthly marketing spend, margins sit at roughly 50%.
Game apps keep users engaged long enough for ads to pay off. Tool apps don't — so if you're building a utility, ads are almost always the wrong call and subscriptions are your only real lever.
Inside SEO Bot, a single button labelled 'Boost My Domain Rating' routes users directly to Listing Bot. That one interaction converts a user of one tool into a user of two — without any marketing cost.
Directory listings are a powerful but underrated growth channel — but only if your product is genuinely interesting enough to earn the click. AI products have a natural advantage here because they're easy to package in a compelling, clickable way.
We use essential and analytics cookies to run Vuci. To understand how the site is used: Privacy Policy.
Install Vuci on your phone
Add it to your home screen for a faster, app-like experience.
Install Vuci on your phone
Tap the Share button, then “Add to Home Screen”.
A new version is available
Reload to get the latest Vuci.