LodeHQ
AI news for people who shipFree, by email

Dev · Tuesday, 4 August 2026 · Issue 66 · 15 stories

Keyv worm hits 430 npm packages; Polonius goes nightly

Languages & Frameworks

Tools & Platforms

Keyv supply-chain worm infects 430 npm packages, steals credentials

On Aug 4 2026 the maintainer of Keyv was compromised, letting attackers push malicious releases to npm. The worm added a preinstall script that drops Bun, runs an obfuscated payload, and exfiltrates npm tokens and other secrets, spreading to over 430 packages with 2 billion monthly installs. Projects depending on these caches now face credential theft.

aikido.dev ↗5 min read at source

DeepSeek V4 Flash runs on a single AMD MI300X with full‑model performance

A single AMD MI300X can host DeepSeek‑V4‑Flash (304B‑parameter) entirely in HBM, delivering 168 tok/s single‑stream decode and up to 830 tok/s aggregate on a 64‑stream burst, all without weight offload or quantization. The repo supplies ROCm patches, Docker stack, and tuning tables that fix FP8 and MoE bugs, proving AMD CDNA3 GPUs are production‑ready for large‑scale LLM serving.

github.com ↗10 min read at source

Gateway API 1.6 Moves TCPRoute & UDPRoute to GA, Adding L4 Support

Version 1.6 upgrades TCPRoute and UDPRoute from experimental to standard v1, giving Kubernetes a native way to route raw TCP and UDP traffic. This closes the gap for workloads like databases, DNS, gaming, and IoT, letting them use the same Gateway API model instead of custom CRDs or plain Services. Controllers can now expose L4 services through a declarative gateway.

kubernetes.io ↗5 min read at source

AI-Assisted Development

condense-json v1.0 trims JSON to save LLM prompt tokens

Simon Willison ships condense-json 1.0, a Python library that compresses JSON objects into a compact token‑friendly form for LLM prompts. The update adds support for keys like $ and $raw, deterministic replacement ordering, and strict error handling, letting developers slash token usage without losing data fidelity.

github.com ↗1 min read at source

Gas Town AI dev tool collapses on Claude Opus 4.7, exposing fragility

Steve Yegge's reusable AI coding environment, Gas Town, ran smoothly on Claude Opus 4.6 but disintegrated with version 4.7 due to a persistent “just two more things” tic. The failure highlights how current AI‑assisted devtools can be brittle, dependent on model quirks, and may not scale to robust, production‑grade workflows.

yegge.ai ↗33 min read at source

Why LLMs Boost Experts, Not Novices

Domain expertise lets you steer LLMs into “expert mode,” extracting higher‑quality output. Terence Tao’s terse, math‑savvy dialogue with ChatGPT shows a master can push the model far beyond what a novice gets, and the same holds for codebases: knowing the system lets you reject, refine, and redirect the model’s suggestions. This debunks the myth that AI makes everyone equally productive.

seangoedecke.com ↗4 min read at source

Why Picking 150 Frames Determines Whether an LLM Actually Watches Video

Vision‑LLMs can only ingest about 150 images per clip, so the frames you keep decide if the model sees the action or just a slideshow. Uniform sampling wastes tokens on redundant shots and skips critical moments; a scene‑score plus rolling‑average filter picks frames that earn their slot. This boosts video understanding without blowing the token budget.

leoaido.com ↗5 min read at source

Engineering Practice

You’re caught up.

That was all 15 stories in the 4 August issue.