How Are Attackers Weaponizing AI in Developer Dependency Attacks?

News includes the release of Expert, the new official Elixir LSP that's already supported by Zed editor, Tidewave Web getting its first major update with editor integration and notifications, Paulo Valente's handoff library v0.2.0 for distributed graph execution across BEAM nodes, LiveDebugger v0.4.0 with new inspect mode and improved features, fascinating research showing Elixir performing exceptionally well in LLM code generation benchmarks (scoring highest among all tested languages), the announcement that next ElixirConf US will be in Chicago, and a critical security alert about a new type of developer dependency attack that weaponizes AI CLI tools, and more!

Show Notes online - http://podcast.thinkingelixir.com/269

Elixir Community News

• https://paraxial.io/ – Paraxial.io is sponsoring today's show! Sign up for a free trial of Paraxial.io today and mention Thinking Elixir when you schedule a demo for a special offer.
• https://github.com/elixir-lang/expert – Expert, the new official Elixir LSP was released
• https://expert-lsp.org/ – Expert LSP official website
• https://github.com/elixir-lang/expert/blob/main/pages/installation.md#editor-specific-setup – Installation instructions for different editors
• https://zed.dev/docs/languages/elixir#expert – Zed editor already supports Expert
• https://x.com/josevalim/status/1960402157922082981 – José Valim announces Tidewave Web first update
• https://tidewave.ai/blog/editor-integration-notifications – Tidewave Web blog post and full changelog
• https://x.com/josevalim/status/1960692138112352355 – José mentions plans to open public roadmap soon
• https://x.com/josevalim/status/1962491846795391333 – José Valim interviewed about Tidewave Web with Ruby focus
• https://rubyai.beehiiv.com/p/ruby-ai-introducing-tidewave-interview-with-jos-valim#interview-with-jose-valim – Full Ruby AI interview with José Valim
• https://x.com/josevalim/status/1960683093225865463 – José discusses Zed's Agent Client Protocol (ACP)
• https://github.com/zed-industries/zed/blob/main/crates/agent_servers/src/claude.rs – Zed working on Claude Code support
• https://github.com/orgs/tidewave-ai/projects/1 – Tidewave's public roadmap
• https://github.com/polvalente/handoff – Paulo Valente's handoff library v0.2.0 for distributed graph execution
• https://x.com/elixirmembrane/status/1961071773438574897 – LiveDebugger v0.4.0 release announcement
• https://forms.gle/V6tUHpJt94vi1v1TA – LiveDebugger feedback form
• https://github.com/software-mansion/live-debugger – LiveDebugger GitHub repository
• https://x.com/josevalim/status/1962649394139877479 – José Valim shares Elixir's exceptional LLM performance results
• https://x.com/tomthesilva/status/1962628935730241712 – Thomas Silva's research on language performance in code generation
• https://github.com/Tencent-Hunyuan/AutoCodeBenchmark – Tencent's AutoCodeBenchmark multilingual coding evaluation
• https://github.com/Tencent-Hunyuan/AutoCodeBenchmark/blob/main/figures/exp_acb.png – Benchmark results showing Elixir's top performance
• https://x.com/hugobarauna/status/1961914102764261688 – Next ElixirConf US announced for Chicago
• Errata correction from José about OIDC implementation attribution to Jonatan Männchen
• https://x.com/zack_overflow/status/1960771720727683507 – New developer dependency attack vector using AI CLI tools
• https://www.stepsecurity.io/blog/supply-chain-security-alert-popular-nx-build-system-package-compromised-with-data-stealing-malware – Supply chain security alert about compromised Nx package
• https://semgrep.dev/blog/2025/security-alert-nx-compromised-to-steal-wallets-and-credentials/ – Semgrep security analysis of the NPM project's Nx compromise
• https://www.anthropic.com/news/claude-for-chrome – Anthropic's post about securing browser interactions

Do you have some Elixir news to share? Tell us at @ThinkingElixir or email at show@thinkingelixir.com

Find us online

• Message the show - Bluesky
• Message the show - X
• Message the show on Fediverse - @ThinkingElixir@genserver.social
• Email the show - show@thinkingelixir.com
• Mark Ericksen on X - @brainlid
• Mark Ericksen on Bluesky - @brainlid.bsky.social
• Mark Ericksen on Fediverse - @brainlid@genserver.social
• David Bernheisel on Bluesky - @david.bernheisel.com
• David Bernheisel on Fediverse - @dbern@genserver.social

Sponsored By:

• Paraxial.io: Paraxial.io is sponsoring today's show! Sign up for a free trial of Paraxial.io today and mention Thinking Elixir when you schedule a demo for a special offer.