Re: Axios remote access trojan (RAT)

https://github.com/axios/axios/issues/10636

Luckily I don't use npm much (only #Indiekit) and it wasn't the malicious v1.14.1 or v0.30.4, it was v1.13.2.

Check with `npm list axios` in your /node_modules folder. I also ran `find ~ -type d -path "*/node_modules/plain-crypto-js" 2>/dev/null` to see if the RAT is found any where on my Mac. 🤞Luckily nothing. Scary! Read the full post mortem report above!

@paulrobertlloyd

#RemoteAccessTrojan #trojan #hack #virus #npm #axios

After discovering #TiddlyWiki from @jbaty, I went ahead to give #FeatherWiki (lightweight TW fork) a spin as a personal #braindump bin. I really like how it’s just a HTML file at 58kb!

Using #Android, it failed due to Android Storage Access Framework (#SAF) limitations. I ended using the amazing #Termux once again to run #Busybox #httpd, automate the whole process of opening, serving & saving back to my…

Full note: https://burgeonlab.com/notes/2026/0325-165827
Syndicated by #Indiekit

#syncthing #bash #wiki #FOSS

WOOT! #Bunnynet finally has #S3 early access! (I missed this notification was one month ago) Really looking forward to using it for my #Indiekit storage needs. Being a big fan of their CDN and #statichosting, I have high hopes.

If you're going to try https://bunny.net for your next web project, consider using my affiliate link:

https://bunny.net?ref=k4vc3x5108

Thank you! Read my experience with Bunny here:

https://burgeonlab.com/support/#bunnynet

#s3bucket #aws #s3storage #cloudstorage #bunnyCDN #bunnyStorage

If you see this post, please interact with it with a reply or like, I will then be able to retrieve your interaction to my blog/AP fedify instance and then I will test replying to your reply to demo threaded reply backfilled to my site
You can also comment using IndieAuth/indieweb if your site support it !

🔗 https://rmendes.net/notes/2026/03/15/fbb7d

Funny how building an ActivityPub plugin for #indiekit fully based on Fedify, migrating my Mastodon account to my own server @[email protected] and building my own UI to consume AP content from the #Fediverse made me use even more than before.

This post is simultaneously a blog post, an #ActivityPub object in the inbox of my followers and a syndicated post to Bluesky.

Next in line? getting inspired by #Wafrn and turn this indiekit/AP instance into my own #Bluesky Pds.

🔗 https://rmendes.net/notes/2026/03/12/a67cd

Two Microsub reader updates this week:

Feed type indicators — each feed now shows its type (RSS, Atom, JSON Feed, h-feed) as a badge, and subscribing to a feed that already exists in another channel returns a clear error instead of silently creating a duplicate. URL normalization catches trailing slash and http/https variants.

Mark source as read — the mark-as-read button is now a split button. The main action marks a single item, but a dropdown caret reveals “Mark {source name} as read” — which bulk-marks all items from that feed in one click. Cards animate out smoothly. Handy when a noisy feed floods a channel and you want to clear it without losing items from other sources.

Both features work in the channel view and the unified timeline view. https://github.com/rmdes/indiekit-endpoint-microsub

🔗 https://rmendes.net/notes/2026/03/11/2e639

Dev Log: Hunting OOM kills, fixing CLS, and making Eleventy builds 10x faster

https://rmendes.net/articles/2026/03/10/dev-log-hunting-oom-kills

Just updated indiekit-deploy (indiekit docker/compose based deployment)

Changes Summary

• Copied from Cloudron — fixes redirect URI validation that rejected hyphens/dots in paths
• Added COPY line to docker/indiekit/Dockerfile

• Two-tier rate limiting (session 50/15min, API 1000/15min) instead of single 250/15min
• Added content negotiation routes for ActivityPub

• From f5f77cb to 48160a5 — 131+ commits of fixes including OG batch spawning, a11y audit, PageSpeed optimization, design system compliance

• Enables post-build GC hook in eleventy.config.js and OG batch spawning GC

• Builds to /data/site/releases/TIMESTAMP/, atomically swaps symlink at /data/site/current
• All 3 Caddyfiles updated: root * /data/site → root * /data/site/current
• First-run migration handles existing flat /data/site volumes
• Keeps 2 releases for rollback

• Was 1536 MB, now matches Cloudron’s production setting
• Needed for OG batch spawning during incremental rebuilds

🔗 https://rmendes.net/notes/2026/03/10/ab5e2

Indiekit beta 27 is out! Thanks @paulrobertlloyd!
https://github.com/getindiekit/indiekit/releases/tag/v1.0.0-beta.27

#Indieweb #indiekit #nodejs

My blog is WCAG 2.1 Level AA compliant… in theory.
Excuse my ignorance but how do I test it to make sure it works for impaired people?

🔗 https://rmendes.net/notes/2026/03/07/8e610