Axios compromised on NPM, 'Open source CAD in the browser' hits 66 HN pts, Combinators explained

Axios compromised on NPM — malicious versions drop a remote access trojan (1,349 HN pts). The most popular HTTP client in the JavaScript ecosystem (400M+ weekly downloads) was supply-chain attacked. Two days after LiteLLM. The npm registry is under siege.

'Open source CAD in the browser' (Solvespace) hits 66 HN pts — parametric CAD running in WebAssembly. No install, no license, no vendor lock-in. Another traditionally native professional tool moving to the browser. The pattern: if it can run in WASM, it will.

Combinators explained (53 HN pts) — foundational computer science content trending on a day dominated by security news. The community reaching for theory when practice is on fire. Combinators as the mathematical foundation underneath the agents everyone is building.

'There is no fix for Intel's branch predictor vulnerability' (128 HN pts) — an unfixable hardware bug in Intel CPUs. Not a software patch away. The chip itself is the vulnerability. Hardware security assumptions that software depends on are breaking.

deer-flow crosses 55K stars (Day 9, +1,800/day) — velocity is finally slowing from 2,400 to 1,800 but the trajectory is still parabolic. ByteDance's agent framework is now the fastest repo to reach 50K in the agent category.

'Why your LLM benchmarks are lying to you' (89 HN pts) — the eval crisis goes mainstream. Models optimizing for benchmarks rather than actual capability. Goodhart's Law applied to AI: when a measure becomes a target, it ceases to be a good measure.