A coordinated npm and PyPI campaign turned Claude Code and VS Code config files into a self-spreading vector, Mira Murati's lab put out its first model and it is an argument with the hands-off-keyboard doctrine, and matklad explains why rust-analyzer's build system is really an org chart. Plus a small rant about cursors, and two builds from the LocalLLaMA subreddit that keep pushing the local-frontier line by hand.

• The mini-shai-hulud campaign — 170 packages, 404 versions, and a self-spreading IDE payload
• Thinking Machines ships TML-Interaction-Small and picks a fight with the autonomous-agent doctrine
• matklad on architecture, incentives, and the build system as a social filter
• Don't hijack the mouse pointer — and what it tells us about cheap effects
• A 1-trillion-parameter Kimi K2.5 running on Intel Optane DIMMs at 4 tokens a second
• Unsloth releases Qwen3.6 with the multi-token prediction layer preserved