Snapshot · This Week in Tech (Audio)
The Arch Linux AUR repository saw over 1,500 packages with injected malware in a supply chain attack affecting Node.js, Plasma, Firefox, and browser packages.
Where this was said
At 2:21:00 · chapter starts 2:15:20
CrowdStrike's report reveals that North Korea's Famous Chollima group — posing as remote IT workers and online recruiters — accounted for 47% of all state-backed intrusions at US tech companies from April 2025 to May 2026. Richard Campbell describes a developer friend who now tests video interview subjects by asking them to close their eyes mid-session, catching AI-generated avatars whose eyelids render incorrectly. Spotify's removal of 57,000 AI-generated fake podcast episodes promoting opioids and cryptocurrency — 94% with zero plays — illustrates the scale of automated platform abuse. The Arch Linux AUR supply chain attack injected malware into 1,500+ packages including Node.js, Plasma 6, and Firefox, with Christina Warren explaining why AUR's low-oversight model makes it particularly vulnerable and noting that even Arch's developers have suggested shutting it down temporarily.
Spotify found and removed 57,000 fake podcast episodes promoting illegal drugs including opioids and modafinil, with 94% having zero plays.
Spotify removed 57,000 fake podcast episodes promoting opioids, modafinil, and crypto on unregulated sites — with 94% having zero plays. The podcasts are almost certainly AI-generated, marking a new vector for automated drug trafficking.
Ad-based monetization works well for game apps where users spend extended time in-session, as seen with Grid and Wordle.
Tool-focused apps like PuffCount are poor candidates for ad monetization because users don't stay in-session long enough.
A hard paywall is a screen that blocks all app features unless the user pays or starts a free trial — it cannot be dismissed.
Mobile apps are primarily monetized through either ads (best for games) or in-app purchases/subscriptions (best for tools).
According to the episode, YouTube outperforms every other social platform for building trust and driving SaaS conversions.
Vasco stated that the majority of his app's user base came directly from his YouTube channel.
SEO Bot features a 'Boost My Domain Rating' button that routes users directly to Listing Bot, an example of in-product cross-selling.
The founder's entire product portfolio is AI-related, making it easier to package products attractively for directories.
The founder attached their SaaS demo to the trending debate about whether AI coding is actually good enough to build a full SaaS product.
We use essential and analytics cookies to run Vuci. To understand how the site is used: Privacy Policy.
Install Vuci on your phone
Add it to your home screen for a faster, app-like experience.
Install Vuci on your phone
Tap the Share button, then “Add to Home Screen”.
A new version is available
Reload to get the latest Vuci.