AI Is Coming for Your Memes, Crypto’s Quantum Clock, Axios Hack| Diet TBPN

0:00John Coogan:Our president here at TBPN, Dylan Abbrascato, headed to the TBPN newsletter, which you can sign up for at tbpn.com, and wrote a fantastic essay summarizing a trend that we've been discussing with him around how AI is changing meme making. And I found it very interesting. I'm glad that he wrote this piece. And so we'll read through this and then discuss it, debate it, and see where we can take it further. And Dylan's from Long Island, New York, so John is going to be trying to do a kind of accent. memes are changing that became abundantly clear during the oscars a few weeks ago when conan tried to create a new leonard du carton leonard ducaprio that's just like ufc announcer to go alongside the classic leo memes in doing so especially by using tfw that feeling when and the blocky white font that defined early internet memes he inadvertently demonstrated that the meme templates millennials grew up with have become increasingly stale, even cringe.

1:02John Coogan:That's a good point. Instead, AI-generated videos are the new meme template that every network and studio should be focusing their launches on. Look at what's happening with the Harry Potter reboot. When the trailer first dropped, the reaction to the new Snape played by Ghanaian, sorry, he's from Ghana, English actor Papa Isidou was predictably and unfortunately negative. According to the LA Times, he received death threats since being cast in the new role. But after a few incredibly viral and well-produced AI videos, one, an original Snape versus Black Snape MMA match, and another AI-generated rap video, and another Dripwarts, The School of Drip, the narrative has started to shift.

1:41John Coogan:Have you seen any of these? The quote-unquote original Snape versus Black Snape MMA match? Because I have not seen this one, and I think it is illustrative of of what Dylan is talking about here. Snape v Snape in the UFC ring. Here we go. Really photorealistic. Are there any red flags here as a UFC enjoyer? Does this feel like a proper UFC? I mean, the actual video quality is insane. He's so bulky. The video quality is insane.

2:20Wait, but old Snape won.

2:21John Coogan:In the fight? Yeah. Okay. But I think it just, okay, wait, how do you know that? It just sort of like makes the characters more entertaining, more fun, shows you that this is just creativity at the end of the day. This is just, you should not be so up in arms about something that's a movie. Like it's entertainment and here's some more entertainment. And so you're adding entertainment to the discussion and people are enjoying that. There's another AI generated rap video about the new Snape, which we can pull up a little bit of here uh ai mean videos are inherently viral and driving real awareness in a way traditional memes no longer can not just because they're novel and more entertaining but because a single ai clip can travel further and compound harder than traditional meme formats and social feeds that now heavily favor video this suggests yeah that's interesting on on x it's still very easy for an image to go viral but if you think about you know instagram youtube like a standalone image just can no longer actually get that escape velocity.

3:19John Coogan:I mean, what about Dripped Out Pope? Remember that? Yeah, a little bit, but people are just spending so much time in the short form feeds. And it can go in there, but there's certainly... This suggests a new playbook for marketers, especially in entertainment. If you're about to drop a trailer for a new movie or show, you need to be thinking about your rage bait character, the one people will latch onto, remix with AI and build around. Conan tried to force a Leo meme down our throats at the Oscars. Didn't see that because I was sleeping. But this might have worked 12 years ago. That playbook is over.

3:51Today enraged fans and communities will, if you're successful, take your characters or moments and turn them into something much bigger, entire cinematic universes. I'm just very impressed by the overall quality of those outputs.

4:03John Coogan:The Oscar selfie. I remember this. This, I think, became the most liked image on Twitter at the time in 2014, briefly. This is the canonical clout bomb. If you're a fan of Bradley Cooper, you like it. If you're a fan of Meryl Streep, you like it. You're a fan of Brad Pitt, you like it. And so you're amplifying all of it. It's the ultimate collab post. And this has become a format that's been used time and time again. But now the future is AI. Let's pull up the Dripwart School of Drip video. I want to watch this one. Let's see if we can play this. That's Harry Potter. Are you really Harry Potter, my G?

4:37Shhh.

4:40John Coogan:Type shit, type shit. Type shit. Type shit. None of that. None of that, Broski. We're all here on the Maybach Express for one reason and one reason only, and that's to go to Dripwatch, the school of drip.

4:53John Coogan:The Maybach pulling the train is pretty good.

5:02John Coogan:So yes, very effective. I was reflecting on this and thinking about how it's not just AI videos that are unlocked as the new meme format. Like, 20 years ago video editing was extremely difficult like you had to do it on a desktop you had to have a piece of software that probably cost a lot of money it was not widely accessible and so these image makers image memes we were I was talking to Brandon about this like good guy Greg was one of these or like the insanity wolf and it would just be like one image of a duck and the duck would be on sort of like a solid colored background and that would be the template and then somebody would put white text with black like block text impact font on the top and the bottom and that was like the image meme and that was accessible in the sense that it could be like generated on MS Paint it was it was it was free to generate it basically then we got video editing you know CapCut Instagram reels as a editor called edits and all of a sudden it became easy for someone to take a vibe reel and put different text over it I send you a bunch of these where I'll find some crazy vibe reel and I'll just recontextualize it with a new new caption basically and so the classic one is like those four jets and the new Top Gun and it's like when you and the boys all drive somewhere in separate cars or something like that but now you can generate full AI videos that can express the joke of the meme and I think the next version of this is like software as a meme, S-A-A-M something like that and we've been experimenting that with this, with the simulators, there's TBPN simulator, Jeremy Giffon simulator, there are more simulators coming.

6:44John Coogan:And all of a sudden, we, you know, the idea of building a video game, becoming a video game studio was like an impossible challenge. It would be months and months of time, maybe millions of dollars to get anything reasonable. So you had to be commercial about it. You could not do it as a comedy bit, but now you can, but increasingly it's going to be more and more just like a few prompts on your phone to get the piece of software that is that meme. And you can think about the Jmail suite from Riley Walls as another software as a meme moment where he's making a commentary on the Jeffrey Epstein saga and all of that, but he's instantiating the humor, the commentary in a piece of software that actually works.

7:28John Coogan:So there is a whole bunch of hack news going on. We're in a very weird week in terms of the news cycle because it's spring break and so a lot of executives of big tech companies are like, don't launch while my kids are out of school and we're going on vacation. I actually think this is my real theory. So we're in a little bit of a slow news week and you can see that like the journal is covering announcements that happened last week. They're talking about Sora, they're talking about Disney, they're talking about things that are more like reflective in Stratechery. Ben Thompson has sort of a 50-year retrospective on Apple.

7:59John Coogan:It's not driven by a news item. Like it's not like Apple launched a new product this week. So Ben Thompson is taking a step back and reflecting. It's a great piece, but there are a ton of crazy hacks starting with Axios. There's an active supply chain attack on Axios, one of NPM's most dependent on packages. So if you have been vibe coding, Axios is a package that helps with HTTP requests. So it gets sucked into all sorts of different projects. And if you upgrade it to the latest version, you basically got a virus with that. And if that's running in the cloud, it's building, and that's probably maybe bad because it could steal API keys or SSH keys.

8:41John Coogan:It could do a lot of things. It could wreak havoc on your system. Also, if you built this piece of software and you included the contaminated Axios installer or package locally, it could potentially weasel its way out of your local environment and get onto to your desktop. It's a virus, so be careful out there. And I'm sure people will be responding. The recommendation from Faros, who sort of broke the news over at Socket Security, is that if you use Axios, pin your version immediately and audit your lock files. Do not upgrade. Socket Analysis confirmed that this was malware. PlainCryptoJS is an obfuscated dropper loader that deobfuscates embedded payloads and operational strings at runtime, dynamically loads FS, OS, and exec sync to evade static analysis, executes decoded shell commands, stages and copies payload files into OS temp, and Windows program data directories, deletes and renames artifacts post-execution to destroy forensic evidence.

9:44So, very risky. I would say, like, if you have installed this, you should just, like, freak out, basically. And if you break your computer, that's like the first thing you should do just like try to slam yeah take the computer throw it

9:58John Coogan:in the lake that's how you should start um i mean practical i mean there is going to be some sort of like power law response here where of the people that are victims of the attack they will go after the most vulnerable with the highest like ransomware potential and i think we're seeing that with uh one company i believe mercore was targeted but i don't know if that's but i don't was that my understanding is that the crazy thing is you have this like Claude Code leak that was completely separate even though I do believe they use Axios in Claude Code and you have the Mercure leak which is it's not a leak, it's a ransom someone stole some data yeah they stole a bunch of data and now they're trying to get bids on it we'll get to that in a little bit and then there's this Axios supply chain attack.

10:51Anish had a little bit more context. He said, a tiny piece of code called Axios runs inside almost every app on your phone and every website you visit. Developers download it 100 million times a week. A few hours ago, someone poisoned it with malware that hands an attacker full control of your computer. If you've never heard of Axios, that's normal. It does one boring but important job. It lets apps talk to the internet. When a website pulls up your feed or an online checkout processes your card, Axios is probably doing the work underneath. Over 173 ,000 other code packages plug into it. It's everywhere.

11:20The attacker stole a lead developer's login for NPM. Think of it as an app store, but for code that programmers use. Once inside, they swapped the developer's email to an autonomous ProtonMail account and uploaded the poisoned version by hand. That jumped past every security check the project normally runs before new code goes live. And this was not a rush job. The stackers staged the malware at least 18 hours before pulling the trigger. They built separate versions for Windows, Mac, and Linux. They poisoned both the current version and an older one within 39 minutes of each other, casting the widest net possible.

11:48Once the malware ran on a machine, it deleted itself to cover its tracks. The trick was smart. They never touched a single line of code inside Axios itself. Instead, they tucked in a fake add-on called PlainCryptoJS, built to pass as a well-known trusted library. It copied the real library's description and author info, so nothing looked off at a glance. When a developer installed Axios, this fake package quietly ran the malware on its own. When a smaller package called UAParserJS got hijacked back in 2021 with about 8 million weekly downloads, the security world treated it like a four-alarm fire.

12:20Axios has$100 million over 12x the exposure with 173 ,000 packages depending on it. Socket, the security firm that flagged this, caught it in about six minutes. That's fast, but six minutes is still plenty of time for automated systems. Ad companies everywhere to pull and install the bad version before anyone can react. If you or your team run Axios, freak TF out. No. Lock your version to 1.14.0. Change every password, API key, and access token on any machine that installed the compromised update. And check your network logs for connections to sfrclak.com or the IP address 142.11.206.73.

12:59John Coogan:Andre Carpathy said, new supply chain attack, this time for NPM Axios. The most popular HTTP client library with 300 million weekly downloads. That's a lot. Scanning my system, Andre Karpathy says he found a use imported from Google Workspace slash CLI from a few days ago when I was experimenting with Gmail, Gcal, CLI. The installed version luckily resolved to the previous version, the unaffected 1.13.5. but the project dependency is not pinned, meaning that if he did this earlier today, the code would have resolved, everything would have updated, and he would have been pwned. It is possible to personally defend against these to some extent with local settings, e.g.

13:45John Coogan:release age constraints or containers or etc. But I think ultimately the defaults of package management projects, pip, npm, etc. have to change so that a single injection, usually luckily fairly temporary in nature due to security scanning, does not spread through users at random and at scale via unpinned dependencies. So very, very crazy, crazy story. I just think it's bullish overall for cybersecurity. Like I think every cybersecurity company will probably do well. People are on edge already. And even though this type of attack has happened for years, long before the popularity of VibeCoding.

14:27It just feels like there's a bunch of new solutions that are needed. The kind of incumbent cybersecurity players will do well. They're going to release a lot of new products. I think the question that I have is, like, why seven minutes, right? Yeah.

14:41John Coogan:Why not check it before it's merged in in the first place? Yeah, yeah, or just, like, you know, these are machines, so theoretically they can be constantly monitoring versus, like... Yeah, I don't know. And the question is, we're going to be digging into this story more over the next few days. But I'm interested to know, like, it's found in seven minutes. When is it actually rolled back? If you look at 300 million weekly downloads, like, clearly there are people that were downloading it at that moment in time. At all seven of those minutes, there's probably, like, thousands of downloads, if not tens of thousands.

15:15John Coogan:Like, how quickly was it rolled back? So is it only if you're in that seven minutes or was it it was discovered in seven minutes and then it took them another 20 minutes to Roll it back and stop serving the contaminated package Understanding the scope of this because it's very clear that as Andre Carpathie explained like he was actively using it every single day And yet was not caught in that seven minute window. And so he was clean and and Understanding the scope and scale of the impact is very much determined by how many just how broad and how many installs happened during the contamination.

15:51John Coogan:Anyway, Will Brown has a good take. He says, I hope someone at Axios is reporting on this, and I completely agree. It's going to be confusing when they do. Last night, odd code, source code, was leaked via map file in the NPM registry. There's just a link to the file. Wait, someone's just actually, do not click a link. If somebody ever says, hey, I got some really great source code here. Just click this link. Probably don't click it. Let other people screenshot it. There's plenty of meta analysis over here. Seems messy, seems unfortunate. Heart goes out to the folks who are dealing with the situation.

16:28John Coogan:At the same time, Codex is open source. It's not the end of the world, but it did reveal a bunch of things about the roadmap and also some of the internal April Fools. That is the worst part. We love a secret surprise April Fools joke. I love a good joke and nothing spoils a joke like hearing about it a day early. Much more importantly, there are lots of other critiques of the way Cloud Code is implemented. What are the bad words? I don't think this hurts their business at all. No. Because people are using Cloud Code to make other products. Yeah. And then also having to take basically a fork of Cloud Code, maintain that, try to be shipping against it, which is, again, I think it seems to not be legal at all to just fork the code base just because it's out there.

17:13Oh, yeah. You can't just steal this of your business. People are converting it into other languages, and maybe there's some argument there, but still, I don't think this hurts their business at all.

17:23John Coogan:It's more like you can just read the architecture, understand some of the secrets, what's special. But at the end of the day, all of these tools, especially something like Cloud Code that's so new, it's more of the process. It's more bad for the overall brand of VibeCoding. Totally, totally. Yeah, it's rough. The irony here is that every time Anthropic has released any feature related to cybersecurity, all the big cyber companies have been selling off tens of billions of dollars. Yeah, yeah, yeah. The question of, like, does this build trust in, like, using VibeCode? Yeah, so overall, it hurts some trust, but again, very obviously going to get through this.

18:02John Coogan:Yeah, so the how it started, how it's going is, of course, landing like a ton of bricks. In the last 30 days, 100 % of the contributions to Cloud Code were written by Cloud Code. And the how it's going is that it leaked the source code, which is not what you want to have happen. This is like, you know, you didn't get to watch the Super Bowl. You have it DVR'd at home. Do you want spoilers? Should we review the April Fool's joke or should we leave it unspoiled? It's cool. It's very cool. You've already read it? I read through it. But it's not to my... Were you belly laughing? I don't think we're getting a knee slapper out of it.

18:39Okay. But it's very cool. I think it'll be cute.

18:42John Coogan:Okay. Well, then we can move on. Tukey summed it up here. Do you understand what just happened to the Anthropic? Someone on their team ran a production build of Cloud Code. The compiler generated a.map file, which is literally a blueprint that reverses the entire code base back to its original source. and then they published it straight to NPM for the whole world to download. And it really does show you how fast the NPM downloads. There are people that are downloading it every single minute. And so even if it's only up there for a minute, someone's going to get it. And then all they need to do is send it to somebody, zip it, and post a link on X, and it goes viral.

19:14John Coogan:It's like locking every door in your house, installing cameras, hiring armed guards, then accidentally uploading your floor plans to Google Maps. Does that matter? No, that's a bad analogy. I don't like that analogy. Floor plans are not why I lock every door in my house. I install cameras. I hire armed guards. Aren't floor plans public on like Zillow? Oftentimes. Let's go over to Lisan Alge. Yes, yes, yes. A few takeaways from the Claude Code leak. Anthropic is actively using Mythos for development. Okay. They are already a Capybara V8. We learned last week that Capybaras are huge but can be deadly in the right context.

19:51Capybara still has issues. The foreshadowing is crazy.

19:54John Coogan:The foreshadowing is crazy. We were talking about how the Faustian bargain that is getting a Capybara as a pet. It seems so cute, but it can bite you. Capybara has one million token. Contact window and fast mode. Cool. Numbat is another interesting codename tagged with at model launch. Remove the section when we launched Numbat. Fennec seems to be the Fennec fox. Fennec fox is very cute, but also not a domesticated animal. How about we get some golden retriever codenames? How about Big Fluffy Poodle? That's a good code name for your animal-themed AI model. Anyway, let me tell you about Console.

20:34John Coogan:Console builds AI agents that automate 70 % of IT, HR, and finance support, giving employees instant resolution for access requests and password resets. And let me also tell you about Lambda. Lambda is the super intelligence cloud, building AI supercomputers for training and inference at scale from one GPU to hundreds of thousands. Arvid says Hot Take, Anthropic leaked Claude Code intentionally to get a Nerdosphere code review it would have never gotten if they had just open sourced it. Oh, that's actually true. Way more attention. You don't leak your entire feature roadmap. I mean, it's funny, and I'm sure they'll make the most of this.

21:08John Coogan:This is 4D chess right here. But I'm not seeing the 4D chess. I'm seeing the 4D chess now. I'm convinced. This is, I mean, we're in completely uncharted territory for marketing stunts and pre-releases and sneaky footage that goes viral and maybe was planted. You don't know. And it's like some leaked account. Like, I don't know. I think everything's, I think the gloves are off. Everything's on the table. This could be an April Fool's joke. This could be a stunt to drive attention to an open source move. Although, Tyler, you said that Dario is not a fan of open source at all, right? He's like against it unilaterally.

21:44He doesn't want to do open source.