The takeaway: A recent social spat highlights the conflicting priorities between Microsoft and open-source projects such as VLC. The universal media player is having issues dealing with MP3 audio files, and the most likely culprit is Redmond’s end-point antivirus software.

Is VLC media player taking tens of seconds to load an MP3 file just because open-source software development is now in an embarrassing state? Jonathan Blow, designer of puzzle games Braid and The Witness, accused the VideoLAN team of doing a very bad job with VLC programming. The VideoLAN team eventually pushed back on the accusation, blaming Microsoft and Windows Defender instead.

In a recent social post, Blow said he was going to switch from VLC to Microsoft Media Player because the former took 33 seconds before playing an MP3 file. Blow’s view is that open-source projects are inherently flawed, while a media player programmed by Microsoft – which has never been known for its expertise in the field to begin with – is now a better alternative to one of the most popular pieces of software on the planet.

According to recent figures provided by VideoLAN, VLC has been downloaded more than 6 billion times on Windows, Linux, Android, macOS, and everything in between. The tool supports six different CPU architectures and numerous hardware-accelerated GPUs, while also providing a lot of additional features like media conversion, recording, internet streaming, IPTV, and much more.

– Jonathan Blow (@Jonathan_Blow) August 12, 2026

As confirmed by VideoLAN, the particular issue experienced by Blow is likely related to a known bug in Microsoft Defender. Redmond’s endpoint antimalware service is now routinely targeting the plugin cache in VLC’s installation folder, putting the cache file in quarantine and causing the player to delay its normal loading times.

Reinstalling VLC or simply regenerating the plugin cache should solve the issue. “Calling open-source software embarrassing when it is a Windows update that broke it is quite disrespectful,” VideoLAN said.

When it comes to false positives and annoying behaviors with legit third-party software, Microsoft Defender is often the first culprit you can safely blame. The VLC plugin cache bug is a well-known issue at this point, with users trying several different solutions to make Defender and VLC finally coexist in peace. Using different antivirus software like Bitdefender Antivirus Free is also a great way to make Defender issues disappear – something I can personally vouch for.

As some users pointed out, using a video player such as VLC to listen to MP3 files doesn’t sound like the most sensible idea to begin with. Furthermore, switching to the “worst media player on the market” (Microsoft Media Player) instead of modern MP3 players such as Foobar2000 is definitely an “embarrassment.”

Sonos could be preparing to launch a new pair of over-ear headphones called the Ace Ultra. An FCC filing suggests the successor could bring voice control and a much wider choice of colours.

The filing, spotted by Lowpass, is heavily redacted, so there isn’t much to go on yet. However, the information that is available points to an over-ear design similar to the original Sonos Ace, which launched in 2024. The Ace Ultra is expected to come in five colours: Greige, Shadow Black, Agave, Blush and Sand.

The FCC filing also appears to reference Sonos Voice Control, which could be one of the more significant additions to the new headphones. Unlike a smart speaker, headphones don’t have a screen for displaying information or controls. Therefore, voice interaction is particularly useful if Sonos is looking to make AI a bigger part of the experience.

The timing also makes sense. Sonos said during its third-quarter financial call that it was planning a product launch in September. However, it hasn’t confirmed which products will appear. CEO Thomas Conrad has also said the company is making AI a core part of its strategy, and the Ace Ultra could potentially play a role in that wider push.

Over the last several years, fusion power has gone from the butt of jokes — always a decade away! — to an increasingly tangible and tantalizing technology that has drawn investors off the sidelines.

The technology may be challenging to master and expensive to build today, but fusion promises to harness the nuclear reaction that powers the sun to generate nearly limitless energy here on Earth. If startups are able to complete commercially viable fusion power plants, then they have the potential to upend trillion-dollar markets.

The bullish wave buoying the fusion industry has been driven by three advances: more powerful computer chips, more sophisticated AI, and powerful high-temperature superconducting magnets. Together, they have helped deliver more sophisticated reactor designs, better simulations, and more complex control schemes.

It doesn’t hurt that, at the end of 2022, a U.S. Department of Energy lab announced that it had produced a controlled fusion reaction that produced more power than the lasers had imparted to the fuel pellet. The experiment had crossed what’s known as scientific breakeven, and while it’s still a long ways from commercial breakeven, where the reaction produces more than the entire facility consumes, it was a long-awaited step that proved the underlying science was sound.

Founders have built on that momentum in recent years, pushing the private fusion industry forward at a rapid pace. Below is a list of startups that have raised over $100 million in committed capital from private investors, according to data provided to TechCrunch by FusionX.

Commonwealth Fusion Systems

Commonwealth Fusion Systems (CFS) has raised about a third of all private capital invested in fusion companies to date. Its latest round, which closed in July, added $1 billion to its coffers, bringing its total raised to $3.94 billion, according to FusionX.

CFS’s catapulted into the lead in 2021 with a $1.8 billion Series B. Since then, the startup has been hard at work in Massachusetts building Sparc, its first-of-a-kind power plant intended to produce power at what it calls “commercially relevant” levels. The company says Sparc should reach scientific breakeven — also known as Q > 1 — sometime in 2027.

Sparc’s reactor is a tokamak design, which resembles a doughnut. The D-shaped cross section is wound with high-temperature superconducting tape, which, when energized, generates a powerful magnetic field that will contain and compress the superheated plasma. Heat generated from the reaction is converted to steam to power a turbine. CFS designed its magnets in collaboration with MIT, where co-founder and CEO Bob Mumgaard worked as a researcher on fusion reactor designs and high-temperature superconductors.

The Massachusetts-based CFS expects to have Sparc operational in late 2026 or early 2027. Later this decade, the company says it will begin construction on Arc, its commercial power plant that will produce 400 megawatts of electricity. The facility will be built near Richmond, Virginia, and Google has agreed to buy half its output.

CFS is backed by a long list of investors, including Breakthrough Energy Ventures, The Engine, Bill Gates, and others.

Helion

Of all fusion startups, Helion has the most aggressive timeline. The company plans to produce electricity from its reactor in 2028. Its first customer? Microsoft.

Helion, based in Everett, Washington, uses a type of reactor called a field-reversed configuration, where magnets surround a reaction chamber that looks like an hourglass with a bulge at the point where the two sides come together. At each end of the hourglass, the reactor spins the plasma into doughnut shapes that are shot toward each other at more than 1 million mph. When they collide in the middle, additional magnets help induce fusion. When fusion occurs, it boosts the plasma’s own magnetic field, which induces an electrical current inside the reactor’s magnetic coils. That electricity is then harvested directly from the machine.

The company most recently raised $465 million in June in a Series G that valued the company at $15.5 billion. Its previous round, announced in January 2025, totaled $425 million. Altogether, Helion has raised $3.2 billion in committed capital, according to FusionX. Investors include Sam Altman, SoftBank Vision Fund 2, Reid Hoffman, KKR, BlackRock, Peter Thiel’s Mithril Capital Management, and Capricorn Investment Group.

TAE Technologies

Founded in 1998, TAE Technologies (formerly known as Tri Alpha Energy) was spun out of the University of California, Irvine by Norman Rostoker. It uses a field-reversed configuration, but with a twist: after the two plasma shots collide in the middle of the reactor, the company bombards the plasma with particle beams to keep it spinning in a cigar shape. That improves the stability of the plasma, allowing more time for fusion to occur and for more heat to be extracted to spin a turbine. 

In December 2025, TAE announced that it would merge with President Donald Trump’s social media company, Trump Media & Technology Group. The all-stock transaction would value the combined company at $6 billion. TAE would receive $200 million plus another $100 million upon filing paperwork with the Securities and Exchange Commission. When the deal was announced, the companies said the combined entity would be led by two co-CEOs, TAE CEO Michl Binderbauer and Trump Media’s CEO, which is currently Kevin McGurn, who is serving in an interim capacity.

The fusion startup had previously raised $150 million in June 2025 from existing investors, including Google, Chevron, and New Enterprise. Prior to the merger announcement, TAE had raised a total of $1.65 billion, according to FusionX.

Pacific Fusion

Pacific Fusion burst out of the gate with a Series A that topped $1 billion, the startup has told TechCrunch. That’s a whopping sum even among well-funded fusion startups. The company will use inertial confinement to achieve fusion, but instead of lasers compressing the fuel, it will use coordinated electromagnetic pulses. The trick is in the timing: All 156 impedance-matched Marx generators need to produce 2 terawatts for 100 nanoseconds, and those pulses need to simultaneously converge on the target.

The company is led by CEO Eric Lander, the scientist who led the Human Genome Project, and chief scientist Will Regan. Pacific Fusion’s funding might be massive, but the startup hasn’t gotten it all at once. Rather, its investors will pay out in tranches when the company achieves specified milestones, an approach that’s common in biotech.

Proxima Fusion

Most investors have favored large startups that are pursuing tokamak designs or some flavor of inertial confinement. But stellarators have shown great promise in scientific experiments, including the Wendelstein 7-X reactor in Germany.

Proxima Fusion is making the most of its proximity to the successful experiment, raising more than $682.9 million across rounds, according to FusionX. The most recent round, which was announced in July, valued the company at $2.7 billion. Investors include Google, RWE, Balderton Capital, Cherry Ventures, East X Ventures, and XTX Ventures.

Stellarators are similar to tokamaks in that they confine plasma in a ring-like shape using powerful magnets. But they do it with a twist — literally. Rather than force plasma into a human-designed ring, stellarators twist and bulge to accommodate the plasma’s quirks. The result should be a plasma that remains stable for longer, increasing the chances of fusion reactions.

Proxima is planning to complete Alpha, it’s net-energy demonstrator, in the early 2030s, and Stellaris, it’s commercial power plant, later that decade.

Shine Technologies

Shine Technologies is taking a cautious — and possibly pragmatic — approach to generating fusion power. Selling electrons from a fusion power plant is years off, so instead, it’s starting by selling neutron testing and medical isotopes. More recently, it has been developing a way to recycle radioactive waste. Shine hasn’t picked an approach for a future fusion reactor, instead saying that it’s developing necessary skills for when that time comes.

The company has raised a total of $1 billion, according to PitchBook. Investors include Energy Ventures Group, Koch Disruptive Technologies, Nucleation Capital, and the Wisconsin Alumni Research Foundation. The company most recently raised a $240 million round in February led by NantWorks with participation from investors including Deerfield Management, Fidelity Management & Research Company, Oaktree Capital Management, Pelican Energy Partners, and the Sumitomo Corporation of Americas.

Inertia Enterprises

Only one fusion experiment, the National Ignition Facility (NIF), has surpassed scientific breakeven, and the chief scientist of that endeavor, Annie Kritcher, is part of Inertia Enterprises‘ founding team. She’s joined by Mike Dunne, a Stanford professor, and Jeff Lawson, who co-founded Twilio and currently owns The Onion. In April, the startup signed three agreements to commercialize the technology developed at the NIF.

Inertia plans to use lasers to bombard fusion fuel pellets, an inertial confinement design that echoes the one Kritcher successfully used at the NIF. Inertia Enterprises emerged from stealth in February with $450 million in Series A funding in a round led by Bessemer Venture Partners with participation from GV, Modern Capital, Threshold Ventures, and others.

General Fusion

Now in its third decade, General Fusion has raised over $442 million, according to FuionX data. The Richmond, British Columbia-based company was founded in 2002 by physicist Michel Laberge, who wanted to prove a different approach to fusion known as magnetized target fusion (MTF). Investors include Jeff Bezos, Temasek, BDC Capital, and Chrysalix Venture Capital.

In a General Fusion’s reactor, a liquid metal wall surrounds a chamber in which plasma is injected. Pistons surrounding the wall push it inward, compressing the plasma inside and sparking a fusion reaction. The resulting neutrons heat the liquid metal, which can be circulated through a heat exchanger to generate steam to spin a turbine.

General Fusion hit a rough patch in spring 2025. The company ran short of cash as it was building LM26, its latest device that it hoped would hit breakeven in 2026. Just days after hitting a key milestone, it laid off 25% of its staff. CEO Greg Twinney penned an open letter pleading for funding from investors. 

In August 2025, they delivered somewhat, injecting $22 million in a pay-to-play round that one investor called “the least amount of capital possible” to keep General Fusion afloat. Then in November, securities filings in Canada revealed that the company had raised $51.1 million in SAFE notes from nearly 70 investors, the Globe and Mail reported.

In January, General Fusion said it would go public via a reverse merger with a special purpose acquisition company. The company listed on the Nasdaq on July 13, 2026, and the transaction net the company $127 million, per FusionX.

Zap Energy

Zap Energy isn’t using high-temperature superconducting magnets or super-powerful lasers to keep its plasma confined. Rather, it zaps the plasma (get it?) with an electric current, which then generates its own magnetic field. The magnetic field compresses the plasma to about 1 millimeter, at which point ignition occurs. The neutrons released by the fusion reaction bombard a liquid metal blanket that surrounds the reactor, heating it up. The liquid metal is then cycled through a heat exchanger, where it produces steam to drive a turbine.

The startup announced a partial pivot in April, saying it will pursue nuclear fission in addition to fusion, while also exploring a hybrid power plant that would blend both nuclear fusion and fission. It also hired a new CEO, Zabrina Johal, who has expertise in the fission industry. Zap claims the move will help it bring in revenue earlier than fusion alone.

The Everett, Washington-based company has raised $325 million, according to FusionX. Backers include Bill Gates’ Breakthrough Energy Ventures, DCVC, Lowercarbon, Energy Impact Partners, Chevron Technology Ventures, and Bill Gates as an angel.

Tokamak Energy

Tokamak Energy takes the usual tokamak design — the doughnut shape — and squishes it, reducing its aspect ratio to the point where the outer bounds start resembling a sphere. Like many other tokamak-based startups, the company uses high-temperature superconducting magnets (the rare earth barium copper oxide, or REBCO, variety). Since its design is more compact than a traditional tokamak, it requires less in the way of magnets, which should reduce costs. 

The Oxfordshire, U.K.-based startup’s ST40 prototype, which looks like a large, steampunk Fabergé egg, generated an ultra-hot, 100-million degree Celsius plasma in 2022. Its next generation, Demo 4, is currently under construction and is intended to test the company’s magnets in “fusion power plant-relevant scenarios.” Tokamak Energy raised $125 million in November 2024 to continue its reactor design and expand its magnet business. In April, the startup said it would be supplying magnets for the U.K.’s STEP Fusion program, a government program that is working toward a spherical tokamak-based power plant.

In total, the company has raised $284 million according to FusionX. Its investors include Future Planet Capital, In-Q-Tel, Midven, and Capri-Sun founder Hans-Peter Wild, according to PitchBook.

Focused Energy

Germany-based Focused Energy is another fusion startup that traces its lineage to the National Ignition Facility (NIF). In addition to using laser pulses to compress a fuel target, the company has hired Debbie Callahan as its chief strategy officer. Callahan helped design the fuel target at NIF. Her job at Focused Energy will be to figure out how to turn the NIF’s painstakingly crafted fuel target into something that can be mass manufactured at a rate of nearly 1 million per day.

Focused Energy raised an oversubscribed $240 million Series A in June, bringing its total private capital raised to $277 million, according to FusionX. The company has also received $200 million in grants. Investors include the German Federal Agency for Breakthrough Innovation (SPRIND), Prime Movers Lab, and the utility RWE, which has granted Focused Energy access to a decommissioned nuclear fission power plant it operates.

Marvel Fusion

Marvel Fusion follows the inertial confinement approach, the same basic technique that the National Ignition Facility used to prove that controlled nuclear fusion reactions could produce more power than was needed to kick them off. Marvel fires powerful lasers at a target embedded with silicon nanostructures that cascade under the bombardment, compressing the fuel to the point of ignition. Because the target is made using silicon, it should be relatively simple to manufacture, leaning on the semiconductor manufacturing industry’s decades of experience.

The inertial confinement fusion startup is building a demonstration facility in collaboration with Colorado State University, which it expects to have operational by 2027. Munich-based Marvel has raised a total of $208 million from investors including b2venture, Deutsche Telekom, Earlybird, and HV Capital with Taavet Hinrikus and Albert Wenger as angels.

Type One Energy

Stellarator startup Type One Energy is planning to build a fusion reactor on the site of a retired Tennessee Valley Authority (TVA) coal power plant. The magnetic confinement device is expected to generate 350 megawatts of electricity, and the company hopes to bring it online by the mid-2030s.

Unlike other fusion startups, Type One plans to sell key technology to organizations like the TVA, allowing them to build, own, and operate the equipment, similar to how many fossil fuel power plants are developed today. Type One has raised $174.5 million to date, according to FusionX, including an extended Series A that totaled $82.5 million. The startup is currently raising a $250 million Series B.

Kyoto Fusioneering

With all the startups pursuing fusion power, it was perhaps inevitable that another would pop up to develop components that round out a power plant. The so-called balance of plant, or the parts that sit outside the reactor, range from gyrotrons that heat plasma to heat extraction systems to harvest power from fusion reactions to turn it into electricity. 

Kyoto Fusioneering has made an early bet that if even one fusion startup succeeds in generating enough power to sell to the grid, that the industry will need a supplier for the balance of plant and the expertise to integrate it into whichever fusion technologies win out.

Venture capitalists appear to agree, having invested $121 million in Kyoto Fusioneering, per FuxionX. Investors include 31Ventures, In-Q-Tel, JIC Venture Growth Investments, Mitsubishi, and Sumitomo Mitsui Trust Investment, according to PitchBook.

First Light Fusion

Unlike many other fusion startups, First Light Fusion doesn’t use magnets to generate the conditions necessary for fusion. Instead, it follows an approach known as inertial confinement, in which fusion fuel pellets are compressed until they ignite. 

But even then, First Light doesn’t hew to orthodoxy. Most attempts at inertial confinement use lasers to do the dirty work, following the lead of the National Ignition Facility, which produced a groundbreaking experiment in 2022. First Light had previously planned to fire a projectile at a target using a two-stage gun, but it has since dropped those plans

Currently, First Light says it is offering its core technologies to other companies looking to build an inertial confinement power plant. A spokesperson for First Light said that it is planning to build “pulsed power capability that would act as our demonstrator plant but would have other science and defense applications.”

Based in Oxfordshire, U.K., First Light has raised $140 million, per FusionX data Its investors include Invesco, IP Group, and Tencent, according to PitchBook.

Thea Energy

Thea Energy is betting its pixel-inspired magnets will help it build a stellarator for less money. Stellarators can keep plasmas burning for long periods of time — a boon when it comes to running a commercial power plant — but to do so, they require twisty magnetic fields. Most stellarators build magnets that mimic that complex shape, but Thea Energy thinks that by wreathing its doughnut-shaped reactor in dozens of smaller magnets, it can use control software to create the necessary kinks.

In May, Thea raised $100 million in a Series B led by the U.S. Innovative Technology Fund, just over two years after a $20 million Series A. Across all rounds, the startup has raised $120 million in private capital. Other investors include Prelude Ventures, Lowercarbon Capital, Hitachi Ventures, and Emerald Technology Ventures.

Xcimer

Though nothing about fusion can be described as simple, Xcimer takes a relatively straightforward approach: follow the basic science that’s behind the National Ignition Facility’s breakthrough net-positive experiment and redesign the technology that underpins it from the ground up. The Colorado-based startup is planning to build a 10-megajoule laser system, 5x more powerful than the NIF setup that made history. Molten salt walls surround the reaction chamber, absorbing heat and protecting the first solid wall from damage. In June, Xcimer turned on Phoenix, a prototype system that it says is the most powerful privately owned laser in the world.

Founded in July 2022, Xcimer has raised $101 million from investors, including Hedosophia, Breakthrough Energy Ventures, Emerson Collective, Gigascale Capital, and Lowercarbon Capital.

This story was originally published in September 2024 and will be continually updated.

The entry-level Joe Rev was created in this same spirit—a full-sized, BMX-inspired frame with fun color options (electric blue, matte gray), 3-inch tan wall balloon tires, and those unmistakable handlebars. There are no apps or fancy readouts, no lights, and no shocks. Just five levels of pedal assist and a throttle attached to a single-speed drivetrain and 750-watt rear-hub motor.

Photograph: Kat Merck

“No cream, no sugar” is even printed on the chain stays, lest one forget the minimalist doctrine. On the plus side, this lack of bones allows the Joe Rev 2 to weigh in on the lighter side at 56 pounds.

This is the second iteration of the original Joe Rev, which is still available (for now) at the sale price of $1,200. The Rev 2 sports a bigger 500 Wh battery with a listed 60-mile range (up from 48 miles) and an updated display. Namely, a 2-by-2.5-inch LCD screen on the left handlebar displaying power level, battery life, and speed, as opposed to the original’s bare-basic hub with buttons.

The battery can be quickly locked and unlocked from the bottom of the frame with a key and charges from red to full green in several hours; it weighs about 7 pounds, so it’s easy enough to carry in a backpack, though at 18 inches long, it could be a tight fit if your bag is already packed.

Photograph: Kat Merck

Photograph: Kat Merck

Teen Spirit

At one point during the testing period, my almost-14-year-old son, who is 5’ 10” and 145 pounds, took the Joe Rev 2 out on a full battery to see how long he could ride in our town of hills. We were all surprised to find he hit the red “recharge” light in about 20 miles. It shouldn’t have been too much of a shock, given that the hills were steep, and he was using the throttle primarily. But it is a good reminder that, like all ebikes, the Joe Rev 2’s range will vary dramatically depending on rider weight, speed, and conditions.

Interestingly, there’s an ominous warning sticker on the Joe Rev’s frame that states no one under 16 is to ride this bike. It does have pedals and a maximum speed of 20 mph, making it a Class 2 ebike—legal in many, if not, most states for kids under 16.

Bottom line: Samsung has begun using Anthropic’s Claude Code in semiconductor design and verification work over the last few months, and the tool has sharply reduced the time required for some engineering tasks. But the company has also encountered errors, including unintended changes and attempts to alter code outside the scope of an assignment. Those issues have kept Samsung’s engineers directly involved in reviewing Claude Code’s output before it can affect a broader chip design.

Claude Code has helped Samsung’s System LSI division complete work that would usually take weeks in a matter of days, according to a report in Chosun Biz. But it has also lowered the severity of error messages instead of fixing the underlying problems, rolled back unrelated completed work, and attempted to modify circuit code it was not meant to touch.

One reported success involved checking the internal data connections of a custom system-on-chip. Nonstandard documentation and a delayed DRAM controller RTL design complicated the work. Claude Code helped engineers create a virtual verification environment, using placeholder blocks for the missing RTL, and develop test scenarios before the full design was available.

The project would normally have taken more than a month, but was completed in about two days, according to the report.

In another case, a second-year engineer used Claude Code to create USB device models for an emulator and adapt an Android driver. The work usually takes about a month, but was reportedly completed in one day.

But Claude Code has also made mistakes. In one case, the AI responded to an error by changing its classification from an error to an informational message rather than correcting it. In another, a request to reverse a feature led the tool to undo unrelated work that had already been completed. It also tried to change register-transfer level (RTL) circuit code without authorization.

The report also noted that Samsung’s System LSI division has about 6,000 employees, compared with around 52,000 at Qualcomm. AI could help Samsung improve development efficiency despite its much smaller workforce.

Claude Code is part of Samsung’s broader effort to use generative AI across its operations. The company also uses tools such as Google Gemini and ChatGPT in research and development, manufacturing, marketing, and support.

Rate this comment as insightful

Rate this comment as funny

You have rated this comment as insightful

You have rated this comment as funny

Flag this comment as abusive/trolling/spam

You have flagged this comment

The first word has already been claimed

The last word has already been claimed

SECURITY

Shai-Hulud variant poisons 444 packages, spreads via tarballs and dev-tool hooks

A new variant of the Shai-Hulud npm worm has poisoned hundreds of packages while adding propagation techniques that can leave little trace in the corresponding source repositories.

In Frank Herbert’s Dune, Shai-Hulud was the name of the giant self-sustaining desert sandworms that moved silently beneath the surface of the planet Arrakis. So it made sense that when some new self-replicating malware with computer worm-like behavior appeared in September 2025, security researchers would name it after Herbert’s fictional creatures.

The latest variant of Shai-Hulud, dubbed “ChainDrop” by Microsoft and others, is no mere sequel, however. Now, the npm community is discovering a Shai-Hulud variant spreading with new stealthy superpowers that circumvent the usual safeguards of open source repositories.  

On August 4, multiple security researchers identified a large-scale npm supply chain attack using this Shai-Hulud variant that had infected 444 packages from multiple publishers, which are collectively downloaded about 2 billion times a month. The operation targeted widely used deep infrastructure dependencies, such as keyv, flat-cache and cache-manager.

Abby Kearns, CEO of enterprise open source security company ActiveState, noted in a Medium post that what is unique about this particular attack is that it doesn’t use the typical methods of breaching the defenses of open source repositories. 

Even if you never install an infected package (“npm install” in npm argot), you can still get the nasties – though that is one possible route of infection. Once triggered, ChainDrop also places startup hooks into the repository configuration files themselves: Simply opening an infected Git branch in VS Code or Claude Code can bring your repository under ChainDrop’s control.

Scouring your code itself may not provide evidence of tampering. ChainDrop propagates not by repository source commits but by tarballs, an archive format for downloading file packages. 

ChainDrop travels by tarball

When executed, the software scours the user’s workspace for npm tokens with full write privileges, as well as for other credentials like cloud keys and secrets. It looks in shell configurations, environment variables and even live memory. Any purloined data is encrypted and sent back to attacker-controlled endpoints.  

Should it find an npm token, it then downloads the tarballs of all the packages that token has full access to, bypassing the repositories themselves. 

That’s the genius part: ChainDrop self-replicates by rebuilding the tarball to include its own payload. Reviewing the source code repository won’t reveal any evidence of shenanigans.

ChainDrop’s attack is two-pronged. It also searches for GitHub credentials. If it finds any, it queries the GitHub API to list all accessible repositories and branches and then commits its malicious configuration code directly into those branches. 

So when other developers open these repositories using Claude or VS Code, a background task gets triggered that harvests credentials, beginning the whole cycle anew. 

What a dev can do 

This attack is particularly pernicious because npm is widely integrated into automated CI/CD pipelines, which can automatically pull patch updates for dependencies during a rebuild – giving the worm a path to wiggle into fresh builds.

If you think you’ve been infected, the first thing to do is check for any .claude/settings.json and .vscode/tasks.json files you did not add yourself, ActiveState’s Kearns advised. And don’t just check the main branch, but all the other branches as well. 

All the infected packages were quickly yanked from npm. Open source security firm SafeDep offers a list of all the compromised packages along with version numbers, so check those against what you currently have running.  

Beyond cleaning up the mess, developers and security teams should rethink how their systems could be breached in light of ChainDrop. 

Trusted publishing tools such as GitHub Actions should be evaluated, for starters. Begin “treating repository-supplied configuration as executable content, because that is what it is now,” Kearns wrote. 

“What this campaign really found was an execution path that dependency scanning tools were not configured to look at, sitting inside the exact tools engineering organizations have spent two years adopting as fast as they could,” Kearns wrote. “This is the first campaign to notice the gap and use it at scale. It will not be the last one.” ®

Do you remember back when electronics came in clear cases? Back around the turn of the millennium, when translucency was chic. [3DSage] sure does, which is why he went to great lengths to make a clear case for his Clear Retro Music Sequencer.

The sequencer itself is based around an ESP32-S3 module with a built-in display, and a rotary encoder that handles most of the input. Most, because there’s a second button and a stylophone-like array of brass rods on one edge of the custom PCB he made with his fiber laser that can also handle note input. Other notable features include a phono jack with built-in switching so the tunes come out automatically from headphones or the internal speaker, and a AAA battery-lookalike. It’s a small detail, but that 666 mWh 3.7 V lithium cell is the demon’s meow for this project, seeing as it gives the convenience of a modern battery without compromising that Y2K look — remember you can see the battery through the translucent case.

About that translucent case: it’s 3D printed out of PETG, with settings similar to those we’ve reported on before: hot, slow, and don’t cross the streams! Which is to say every layer must line up with the one above. Oh, use filament fresh out of the drier of you live somewhere as humid as [3DSage]. The result is not totally see-through, but an application of clear enamel fills in the surface well enough to read through, giving the vintage look [3DSage] was after. To complete that Y2K feel, he turns the device into a slap bracelet, because why not? For those of you who missed due to the aforementioned federal prison arc, slap-on wristbands were all the rage amongst the kids back in those days.

The wristband is a length of measuring tape at its core, the springy steel having been cold-worked to hold the radius of [3DSage]’s wrist in its relaxed state, encapsulated in clear gorilla tape for comfort. We probably don’t have to tell you that getting slapped with a raw tape measure isn’t the nicest. For the actual operation of the sequencer, check out the video embedded below — the first 9 minutes cover the build, while the rest shows off the product.

Of course you don’t need an ESP32 for this kind of music maker– you can do it with a C64, or even discrete parts and rope-core memory.