#208 — Tue 24 March 2026 by Evan Chen

On the litellm attack:

We discovered it when the package was pulled in as a transitive dependency by an MCP plugin running inside Cursor. The .pth launcher spawns a child Python process via subprocess.Popen, but because .pth files trigger on every interpreter startup, the child re-triggers the same .pth — creating an exponential fork bomb that crashed the machine. The fork bomb is actually a bug in the malware.

(Passed to me by a work colleague.)

#207 — Mon 23 March 2026 by Evan Chen

Man, I can just like, upload whatever I want to PyPI and it's great.

#206 — Sun 22 March 2026 by Evan Chen

I really want to like biome, but having to have a configuration file to cause it to use spaces over tabs (the default for prettier) isn't great. I don't have .prettierrc and don't really want to start with biome.json either.

#205 — Sat 21 March 2026 by Evan Chen

What does it say about me that tinkering with CI is more addictive than Netflix?

#204 — Sat 21 March 2026 by Evan Chen

python -m http.server is such a nice built-in command and I wish I knew about it like ten years ago