Apache Projects Reach Top-Level Status: Auron, Reqsign, ResilientDB

CloudSEK and Checkmarx tracked down MALFEX, a years-long npm supply chain campaign run by a single operator who's published 12 packages since August 2023 — 8 of them malicious, with 40,767 combined downloads. The mechanisms vary by package. Three (tlxbnhd, tldriver, mxdriver) use lifecycle hooks to download and run a Windows executable that loads the Overlord RAT, an open-source trojan that gets its C2 address from Solana blockchain transactions. Two others chain together to fetch a Node.js stealer targeting Discord, browsers, Telegram, and crypto wallets. The most popular package, function-flag (37,419 of the total downloads), runs a postinstall hook whose payload location changes with every version — in one version, per Checkmarx, the trigger is disguised as an ASCII-art font call. None of this requires a sophisticated zero-day. It requires a postinstall script nobody questioned, running with the same trust as the rest of the install. That's the gap command governance closes. Lifecycle hooks are commands like any other — they deserve the same check before they execute that any shell command an agent proposes would get, instead of an automatic pass just because npm install triggered them. https://agentguards.co #SupplyChainSecurity #OpenSource #AppSec #DevSecOps

# Hive Engine Knobs A/B/C **Performance work on a blockchain node is as much about restraint as optimization.** Over the past few months, I’ve been contributing a series of incremental improvements to the Hive-Engine node. Rather than bundle a broad set of changes into one difficult-to-review release, we split the work into three focused parts: - **Knobs A:** Make JavaScript VM and MongoDB connection-pool settings configurable. - **Knobs B:** Batch transaction-index writes and warm the VM pool predictably on first use. - **Knobs C:** Let block-fetch concurrency and lookahead adapt when a node is catching up. The engineering constraint throughout was clear: improve the plumbing without changing transaction order or consensus behavior, and preserve existing defaults for operators who don’t opt in. We also tested the changes against real operating conditions. For Knobs C, I let my witness node fall roughly 300 Hive blocks behind and monitored its catch-up. It returned to the head, with hashes matching at the sampled checkpoints. The broader lesson: in consensus-adjacent systems, smaller changes with explicit safety boundaries are easier to review, test, and operate. Breaking the work into three smaller pieces made a big difference. It gave maintainers room to review each change on its own, while still moving the whole effort forward: A, B, and C reached QA and live testing in about six weeks. The changes stayed focused, and we didn’t have to ask anyone to swallow one giant performance rewrite. Thanks to the Hive-Engine maintainers and community for the review and feedback. I’m looking forward to the next round of improvements. #Hive #Blockchain #OpenSource #SoftwareEngineering

My morning today. 6.30am: *Reads copious amounts of notes about a Web3 client and how they used Cloud SQL, PostGreSQL, XYZ-and-who-knows-what-else... so as to confidently ask on a call: "Every blockchain ecosystem is different. How do your Python and Airflow pipelines handle those schema differences?"* 8am: *Coming up with these award-winning lyrics on the fly to quiet my sparring kids and get them to eat breakfast: "Chocolate and blueberries in my tum tum tum, They are yummy yummy yum yum yum."* I challenge you to show me a more stimulating way to start your day.

How does Git know which files changed? How does Cassandra sync two nodes without comparing every record? How does a blockchain verify millions of transactions in milliseconds? The answer to all three is Merkle trees. A Merkle tree is a binary tree where every leaf node contains the hash of a data block, and every parent node contains the hash of its children. The single node at the top, the root hash, is a fingerprint of everything below it. To check whether two datasets are identical, you compare root hashes. If they match, every byte in both datasets is identical. If they don't, you walk down the tree: compare left children, then right. The mismatch tells you exactly which subtree diverged. You've gone from comparing everything to a logarithmic search. Practical uses: Git stores your repository as a Merkle tree. Each commit hashes its tree of files. Each tree node hashes its subtrees and blobs. Change one byte in one file and only the hashes on that branch change. Git knows what's different without diffing every file. Cassandra uses Merkle trees during anti-entropy repair. Two nodes build a Merkle tree of their data for a token range, exchange root hashes, and walk down only the mismatched branches to find what needs syncing. Bitcoin's block headers contain a Merkle root of all transactions in that block. A light client can verify a single transaction is included without downloading the entire block. The pattern: hash up, compare down. Find divergence in O(log n) instead of O(n). Where in your system are you doing full comparisons when a tree would do?

B-Trees are easy to understand. Their real cost shows up when your database grows. In a blockchain indexer, every operation has a cost. 🔍 Reads depend on how efficiently the index finds the right entry. ➕ Inserts must maintain the index structure. 🔄 Updates can mean more index maintenance, depending on which columns change. 🗑️ Deletes introduce cleanup work that doesn’t necessarily end when the SQL statement finishes. At small scale, these costs can be easy to overlook. At production scale, with continuous ingestion and billions of indexed records, they become architectural decisions. I’ve written a deep dive into how B-Trees behave across reads, inserts, updates, and deletes, and what these trade-offs mean when building a real-time blockchain indexer with PostgreSQL. The goal isn’t just to understand how indexes work. It’s to understand what they cost, when that cost matters, and how to make better engineering decisions. 📖 Read the full article: https://lnkd.in/dB4psVCB If you’re working with PostgreSQL, high-throughput systems, or large-scale data ingestion, I’d love to hear your experiences. What’s the most surprising index-related performance issue you’ve encountered in production? #PostgreSQL #DatabaseEngineering #PerformanceEngineering #SystemDesign #Blockchain

Blockchain developers often overlook the serverless architectures that can optimize their DePIN infrastructure. ```yaml # AWS Lambda function deployment provider: name: aws runtime: nodejs14.x region: us-east-1 functions: hello: handler: index.handler timeout: 5 ``` AWS Lambda offers robust scalability for handling blockchain transactions. ```javascript // Cloudflare Worker example addEventListener('fetch', event => { event.respondWith(handleRequest(event.request)) }) async function handleRequest(request) { return new Response('Hello, DePIN!', {status: 200}) } ``` Cloudflare Workers provide global edge computing, ensuring fast and secure API responses. ```bash # Vercel deployment snippet # Run `vercel` in the project directory # vercel.json configuration { "version": 2, "functions": { "api/*.js": { "runtime": "nodejs14.x" } } } ``` Vercel excels in deploying frontends and static sites with serverless functions. Adopting these serverless architectures can significantly boost your DevOps productivity and project scalability. Have you integrated any of these services into your DePIN projects? #DevOps #CloudComputing #Kubernetes

CouchDB, Blockchain & Distributed Systems: What Makes Them a Powerful Combination? While working in the CBDC ecosystem at NPCI, I got exposure to how Apache CouchDB is used to store blockchain-related information in a distributed environment.This sparked my interest in understanding why CouchDB is chosen for certain blockchain workloads instead of other popular databases like MongoDB. Here are a few interesting takeaways: 🔹 1. JSON Document Storage: CouchDB stores information as JSON documents, making it useful for managing structured blockchain-related data and application state. 🔹 2. Distributed Data Replication: Its built-in replication capabilities allow databases to synchronize changes across different instances, making replication an important concept in distributed system design. 🔹 3. Rich Queries and Indexing: CouchDB supports querying JSON documents using Mango queries and indexes, enabling applications to retrieve information based on specific attributes. 🔹 4. Understanding the Right Database for the Right Workload: MongoDB, PostgreSQL, CouchDB and other databases each have their own strengths. The right choice depends on consistency requirements, query patterns, replication needs and application architecture. 🔹 5. The DevOps/SRE Perspective: Running databases in production is not just about deploying containers. It involves persistent storage, high availability, resource optimization, monitoring, backup and recovery, and troubleshooting under real-world conditions. 💡 One important distinction: Blockchain and database replication are not the same thing. Blockchain provides mechanisms for maintaining ledger integrity and validating transactions, while CouchDB serves as a database for the relevant application or ledger state in supported architectures.For example, in Hyperledger Fabric, CouchDB can be used as the world-state database when rich JSON queries are required. The more I explore distributed systems, the more I realize that choosing a technology is only one part of the challenge. Understanding why it was chosen, how it behaves under failure, and how to operate it reliably is equally important. Id love to hear from the community: Where have you used CouchDB in production, and what made you choose it over MongoDB or another database? #ApacheCouchDB #Blockchain #CBDC #DistributedSystems #DevOps #SRE #Kubernetes #DatabaseEngineering #HyperledgerFabric

10 Best Blast API Rivals for Web3 Infrastructure The right Web3 infrastructure can make a big difference for applications that depend on fast and reliable access to the blockchain. Blast API offers useful infrastructure for developers, but it may not meet all of your project’s needs in terms of network coverage, scalability, pricing or developer tools. In this guide, I will introduce best Blast API alternatives for Web3 infrastructure including Alchemy, QuickNode, Infura, Ankr, Chainstack, dRPC, Tatum, NOWNodes, GetBlock and Helius and compare what they offer for different Web3 development needs....

KISS vs Over-Engineering — The most expensive lesson my friend ever learned 👇 Back in 2022, a client asked a friend of mine for a simple feature toggle: "Enable / Disable feature". His brain: "Let's make it scalable!" What he built: Microservices, API Gateway, K8s, Redis cluster, Kafka, AI inference, Blockchain audit trail... Time to build: 3 weeks AWS bill: $150/month for a CHECKBOX Time to debug when it broke: 2 days What the client actually wanted: <input type="checkbox"> Time needed: 10 minutes. Lesson: Simple => Clever. Always ship the simplest thing that works, then scale IF needed. Has a friend (or you!) ever over-engineered something? Drop the story below — let's laugh and learn 😅 #KISS #Programming #SoftwareEngineering #CleanCode #DeveloperHumor

10 Top Moralis Alternatives for Enterprise Web3 APIs 2026 For enterprises building scalable blockchain applications, the right Web3 API provider can be a game changer. Although Moralis provides a full suite of tools for developers, some entities might need other options that include broader data coverage, more robust infrastructure, flexible pricing, or specific enterprise capabilities. In this guide, we’ll cover the best Moralis alternatives for enterprise Web3 APIs, including platforms to power demanding workloads, multi-chain development, real-time data, and production-grade apps....