WEBVTT NOTE The Rundown — nextbig.dev daily audio edition, 2026-04-01 1 00:00:02.600 --> 00:00:13.360 Your software supply chain is under active attack. It's Wednesday, April first, and two separate poisoned-package incidents landed in a single news cycle. 2 00:00:13.540 --> 00:00:33.850 Axios, one of the most depended-on HTTP libraries in JavaScript, was compromised on npm. Malicious versions were published that drop a remote-access trojan onto the machine that installs them. This is a live supply-chain attack, and StepSecurity documented the full chain. 3 00:00:33.850 --> 00:00:48.300 The same week, Anthropic inadvertently shipped a source map in its npm package that exposed Claude Code's full source. Two high-profile npm incidents at once. 4 00:00:48.300 --> 00:01:04.090 The registry is the largest attack surface most shipping teams have. If you aren't pinning versions, running audit checks in CI, or watching for unexpected dependency changes, that's the gap. Check your lockfile before the next build. 5 00:01:04.270 --> 00:01:25.440 Elsewhere in the toolchain, Microsoft open-sourced Agent Lightning, a framework for training AI agents that learn from environment feedback rather than prompting. And Ollama moved its Apple Silicon backend to Apple's native MLX, making local models meaningfully faster for development. 6 00:01:25.440 --> 00:01:41.140 Oracle, meanwhile, cut thirty thousand jobs as it leans into cloud and AI. Reduced headcount tends to mean reduced support, one more reason teams are re-evaluating where their workloads live. 7 00:01:41.320 --> 00:01:52.900 No call filed today. The one thing to watch: supply-chain security moving from a nice-to-have to a hard requirement in CI over the next six months. 8 00:01:52.900 --> 00:01:57.890 Treat your dependency graph like infrastructure, because attackers already do.