Ransomware in VS Code Extensions + Your First ML Deploy

Nothing says "move fast and break things" quite like ransomware in your code editor—but hey, at least we're also shipping ML models today.

Hello Builders! 👋

This morning we're covering a malicious VS Code extension with built-in ransomware capabilities (yes, really), plus Google's new ADK Go toolkit for AI development, and a beginner-friendly guide to deploying your first machine learning project with Pandas and Scikit-learn.

Well, this is nightmare fuel for your Friday evening. Someone just published a malicious VS Code extension with built-in ransomware capabilities to the marketplace. Not a typo-squat of a popular extension, not some sketchy theme pack—an extension literally named "Vibe-Coded" that could encrypt your files and hold them hostage.

The audacity is almost impressive. We've all gotten comfortable clicking "install" on extensions without a second thought, treating the VS Code marketplace like it's some walled garden of safety. Spoiler: it's not. This is your periodic reminder that supply chain attacks aren't just about npm packages anymore—they're coming for your entire dev environment.

The extension has since been yanked, but here's the thing: how many people installed it before someone noticed? How many other extensions are sitting there right now, waiting? Maybe it's time to actually read those permission requests instead of instinctively clicking "allow" like we're dismissing cookie banners.

ADK Go - Google's new open-source toolkit for building AI agents in Go. Finally, something for the backend folks who've been watching Python devs have all the fun.

Teable 2.0 - AI database agent that processes receipts, resumes, and generates marketing materials. Hit 20k GitHub stars, which means it's either genuinely useful or has great docs.

Firebase Studio - Cloud IDE combining Firebase platform with Gemini AI agents for full-stack development. Google really wants you to never leave their ecosystem.

ChatGPT Built-in Apps - TripAdvisor and Peloton launch as ChatGPT's first native apps. OpenAI is building an app store while Apple and Google pretend AI doesn't exist.

Introducing Nested Learning: A new ML paradigm for continual learning - Google Research drops another paper on continual learning. Models that actually learn without forgetting everything? We'll believe it when fine-tuning doesn't nuke our base model.

20-Minute Claude Code Tutorial for Non-Technical Founders - @FarzaTV recorded himself teaching his non-technical buddy how to build a real product with Claude. No fluff, just the actual workflow that works.

Your First ML Project: Dataset to Deployed Model - Beginner-friendly walkthrough building an income prediction model with Pandas and scikit-learn. The kind of tutorial that actually explains the "why" behind each step.

How to Actually Use GPT-5 - Guide to GPT-5's features and settings beyond "just prompt it better." Covers which settings matter for different use cases and which ones are basically placebo buttons.

Vibe coding saved hours on MVP - Traditional devs hate it, but shipping fast matters. The "real developers write assembly" crowd needs to chill.

What AI coding tools don't tell you - Reality check: you still need to code, debug, and understand logic. AI builds scaffolding, not finished products.

From idea guy to idea guy who codes - Cursor enabled solo shipping at previous dev team level. This is the actual use case, not replacing senior engineers.

Opus breaking everything speedrun - Claude's Opus model will happily burn your token budget and break your codebase. Choose your model wisely.

Leaving Meta and PyTorch - Soumith Chintala, PyTorch's creator, is leaving Meta after a decade. End of an era for the framework that ate TensorFlow's lunch.

Sam Altman says OpenAI has $20B ARR and about $1.4 trillion in data center commitments - That's trillion with a T. Either the most ambitious infrastructure bet in tech history or we're watching someone speedrun the dot-com bubble.

Sam Altman says he doesn't want the government to bail out OpenAI if it fails - Cool, cool. Definitely what you say when you're not planning to need a bailout for your $1.4 trillion data center bet.

Quora CEO on vibecoding being under-hyped - Adam D'Angelo claims everyone will create what took 100 engineers. Bold prediction from someone who actually ships code.

Sora for Android - 500k installs on day one, 327% more than iOS launch. Turns out there are more Android users than iPhone users—shocking absolutely no one outside Cupertino.

One-command data stack - 514 built a full dev environment (database, APIs, pipelines) that spins up with a single line of code. Docker Compose wishes it were this elegant.

Agents improving faster than the discourse - While everyone argues about AGI timelines, computer-use agents are quietly getting reliable. The quiet part matters more than the loud part.

Gemini App Update - New features announcement from Google AI

v0 Development Tool - Vercel's AI-powered interface generation platform

AI Research Highlight - Latest machine learning breakthrough coverage

Legible Software Research - Alternative to vibe-based coding methodology

Business AI Insights - Enterprise AI implementation strategies

The people who'll dominate 2025 aren't the ones with the biggest teams or fattest funding rounds. They're the ones who ship something every single week, even if it's tiny. Consistency is eating strategy for breakfast.

So what are you building right now? Not the big vision stuff—I mean what's actually in your code editor or design file today? What's the one feature you're wrestling with this week? Hit reply and tell me.

Keep shipping,

P.S. If you've been "planning to start" something for more than a month, this is your sign to just build the ugly version this weekend. I'll wait. Actually, I won't wait—I'll be shipping too.