Flux
asgi-gzip 0.3

asgi-gzip 0.3

Release: asgi-gzip 0.3 I ran into trouble deploying a new feature using SSE to a production Datasette instance, and it turned out that instance was using datasette-gzip which uses asgi-gzip which was incorrectly compressing event/text-stream responses. asgi-gzip was extracted from Starlette, and has a GitHub Actions scheduled workflow to check Starlette for updates that need to be ported to the library... but that action had stopped running and hence had missed Starlette's own fix for this…

Simon Willison's Weblog
Meta's new model is Muse Spark, and meta.ai chat has some interesting tools

Meta's new model is Muse Spark, and meta.ai chat has some interesting tools

Meta announced Muse Spark today, their first model release since Llama 4 almost exactly a year ago. It's hosted, not open weights, and the API is currently "a private API preview to select users", but you can try it out today on meta.ai (Facebook or Instagram login required). Meta's self-reported benchmarks show it competitive with Opus 4.6, Gemini 3.1 Pro, and GPT 5.4 on selected benchmarks, though notably behind on Terminal-Bench 2.0. Meta themselves say they "continue to invest in areas with…

Simon Willison's Weblog
Feross on TBPN: How North Korea Hijacked Axios

Feross on TBPN: How North Korea Hijacked Axios

Socket CEO Feross Aboukhadijeh joined the TBPN podcast today to break down the Axios npm supply chain attack, one of the most significant open source compromises in recent months. TBPN, recently acquired by OpenAI, is a live daily tech show hosted by John Coogan and Jordi Hays. Feross walked through how North Korean state actors socially engineered the lead Axios maintainer over weeks, building a fake company, a fake Slack workspace, and a staged Microsoft Teams call before delivering malware…

Socket
Attackers Are Impersonating a Linux Foundation Leader in Slack to Target Open Source Developers

Attackers Are Impersonating a Linux Foundation Leader in Slack to Target Open Source Developers

A social engineering campaign is actively targeting open source developers through Slack, according to a high-severity advisory posted April 7 to the OpenSSF Siren mailing list. The attacker impersonates a known Linux Foundation community leader to lure victims into a multi-stage attack that ends with malware delivery and potential full system compromise. OpenSSF Siren is a public threat intelligence mailing list run by the Open Source Security Foundation (OpenSSF), a Linux Foundation project.…

Socket
North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

North Korea’s Contagious Interview Campaign Spreads Across 5 Ecosystems, Delivering Staged RAT Payloads

We have been tracking North Korea’s Contagious Interview operation since 2024 and maintain a dedicated campaign page that now tracks more than 1,700 malicious packages linked to the activity. In this newly identified cluster, the threat actors operated under GitHub aliases including golangorg and published malicious packages across five open source ecosystems: npm: dev-log-core, logger-base, logkitx PyPI: logutilkit, apachelicense, fluxhttp, and license-utils-kit Go Modules:…

Socket
GLM-5.1: Towards Long-Horizon Tasks

GLM-5.1: Towards Long-Horizon Tasks

GLM-5.1: Towards Long-Horizon Tasks Chinese AI lab Z.ai's latest model is a giant 754B parameter 1.51TB (on Hugging Face) MIT-licensed monster - the same size as their previous GLM-5 release, and sharing the same paper. It's available via OpenRouter so I asked it to draw me a pelican: llm install llm-openrouter llm -m openrouter/z-ai/glm-5.1 'Generate an SVG of a pelican on a bicycle' And something new happened... unprompted, the model decided to give me an HTML page that included both the SVG…

Simon Willison's Weblog
Esc