Practical defenses for package installs

Scott and Wes break down a chaotic week in dev news — the Claude Code source leak, a nasty Axios npm supply chain hack, and Railway’s private cache exposure — plus how to keep these nightmare scenarios from hitting your own projects.

Show Notes

• 00:00 Welcome to Syntax!
• 00:55 Claude Code Leaked!
  • Wes’ X Post
  • Apple Source Code Video
• 05:42 Burning through Claude Code token limits.
  • Reddit Thread
• 08:57 Axios hacked!
  • Step Security
  • pnpm Supply Chain Security
  • pnpm minimumReleaseAge
• 16:13 Pretext blew up!
  • Pretext.js Demos
  • Wes’ Demo
• 27:24 Railway shared private cache.
  • Railway Incident Report
• 31:54 Sick Picks & Shameless Plugs.

Sick Picks

• Scott: Kindle Colorsoft Kids
• Wes: UGREEN 200W 8-Port GaN USB C Charger Block, Wyze Headphones

Shameless Plugs

• Scott: Syntax on YouTube

Hit us up on Socials!

Syntax: X Instagram Tiktok LinkedIn Threads

Wes: X Instagram Tiktok LinkedIn Threads

Scott: X Instagram Tiktok LinkedIn Threads

Randy: X Instagram YouTube Threads