Video · 2026-08-04 · 1h 20m · 6 moments

Cloudflare Wallets ⟡ A REAL React Compiler Released ⟡ OpenAI's Pricing War ⌁ Syntax Weekly ⌁

✦ AI generated

GUEST Wes (Host)GUEST Scott (Host)GUEST CJ (Host)

timeline · colored by role

Fact

A new Shy Halute-style worm compromised 868 packages carrying over 2 billion monthly installs, and the mitigation is to block packages not yet available for a day and prefer PNPM.

Scott reports an active supply-chain worm (started via the Keeyv package) that has hit 868 packages and 2 billion monthly installs, dropping a stealer that sweeps npm, GitHub, AWS, Kubernetes, and Vault secrets and spreads to other maintainers.

transcript

Scott (Host): today there is a new Shy Hallude attack going down and one which has already compromised 868 packages carrying over 2 billion monthly installs... the main package that was compromised it started with this Keev package... the advice that we always give you on these worms is that you should be setting your packages not to install things that have not been available for at least a day or so. PNPM, npm, they all have this feature. Um so PNPM has it by default... A pre-install hook fires on npm install and drops a stealer that sweeps npm, GitHub, AWS, Kubernetes, and Vault secrets and then spreads to more maintainers.

gives example · 1

Claim

These supply-chain hacks mostly aren't draining Bitcoin wallets; they steal AI tokens and access quietly enough that victims don't notice, then resell them on the black market.

Scott points out that these worm attacks rarely produce immediate visible wallet-drain stories; instead the stolen AI tokens and access are farmed quietly and sold on the black market, a topic he explores by buying such stolen tokens in an upcoming video.

transcript

Scott (Host): One interesting thing about all of these attacks is that you're not hearing these stories of there was an attack and these Bitcoin wallets were drained immediately... a lot of these hacks, they're stealing your AI tokens or they're stealing access to your uh to whatever app you have and then they are just stealing enough that you won't notice it. And they're selling those on the black market... I actually go ahead and buy some of these black market tokens that are often stolen in these attacks.

explains mechanism · 1gives example · 1provides context · 1

Fact

Cloudflare Wallets let you give an agent a crypto wallet holding stablecoins so it can pay for inference, data, and other services, including reserved on-chain identities.

Wes covers Cloudflare's newly announced agent wallets: crypto wallets holding stablecoins that let agents send and receive payment for inference tokens or paid data, built on the open X42 Payment Required standard and linked to a reserved handle on cloudflare.pay.

transcript

Wes (Host): Cloudflare wallets have been announced which essentially just wallet for your agent... the X42 payment required standard which is essentially this way for agents to be able to pay for access to whatever it is you want... the Cloudflare wallet, which is essentially going to allow you to give a wallet which can hold stable coins... these wallets will do is you'll be able to both send and receive. So you can pay for things with... you can give it like $20 and say go complete this task for me... you can register your handle on cloudflare.pay.

gives example · 1

Claim◆

Octane is a new framework by Dominic Gannaway that compiles React code to vanilla JS with no virtual DOM, while keeping React's programming model, explaining that the 'React compiler' released by the React team is only an optimizer, not a real compiler.

CJ introduces Octane, a framework from the creator of RippleJS that uses what he calls the 'React programming model compiled': you write React code, swap the import, and it bundles to smaller, faster vanilla JS with direct DOM updates and no reactive runtime.

transcript

CJ (Host): The React compiler was released version one back in October of 2025... I have complained about this that it's not actually a compiler. It's more so a React optimizer... But the main tagline here is basically swap out React with Octane. And now when you bundle your app, it's going to be smaller automatically. It's going to be faster because it doesn't use the virtual DOM. And it's backwards compatible... Everything gets compiled into vanilla.js with update code to change the DOM directly if state variables change... this is the new framework from Dominic Ganoway he knows what they're doing.

Claim

OpenAI is discounting its mid-tier Terra model by 20% and its low-tier, faster Luna model by 80%, partly to steer users toward cheaper tiers and to compete with cheaper emerging Chinese models.

West argues OpenAI's price cuts on Terra (-20%) and Luna (-80%) are an attempt to get users who default to the best model to try cheaper tiers, and to prevent them from switching to cheaper Chinese providers.

transcript

Wes (Host): their Terra, which is the middle one, is now 20% cheaper and Luna, which is their lower one and significantly faster, is 80% off... people are just defaulting to using the best one... And I think that this is probably a push to get people to say, 'Ah, that's significantly cheaper... I'm going to try it now.'... the other reason they're doing this is simply just all of these Chinese models coming out recently that are significantly cheaper... you don't want people switching to an entirely different provider.

provides context · 1

Claim◆

AI-generated video podcast content fails because AI writes bad scripts that people instantly recognize as slop, destroying credibility — the value of this content is the human take, not an AI summary.

Wes critiques Hey Gen's new AI video podcast feature: technically impressive but likely unwanted for most, with its best uses being summarization and training content; the core problem is that AI-written scripts are instantly recognizable, and people listen for the human's interpretation, not a canned AI digest.

transcript

Wes (Host): it's technically extremely impressive that this looks really good... But on the same side, I don't know that people necessarily want this type of thing where it is just entirely AI generated... AI sucks at actually like writing a good script for this type of thing... I can within like 5 seconds I can hear when somebody has used ChatGPT or AI to write a script... people don't want to hear your garbage AI script... We listen to this type of stuff for the person, for their take on it, for their reaction to it, not for some garbage summarized version of it.

Highlight slides

Octane: React Programming Model, Compiled✦ from: Octane is a new framework by Dominic Gannaway that compiles React code to vanilla JS with no virtual DOM, while keeping React's programming model, explaining that the 'React compiler' released by the React team is only an optimizer, not a real compiler.AI Video Podcast Slop Fails Because of the Scripts✦ from: AI-generated video podcast content fails because AI writes bad scripts that people instantly recognize as slop, destroying credibility — the value of this content is the human take, not an AI summary.People Listen for the Human Take, Not an AI Digest✦ from: AI-generated video podcast content fails because AI writes bad scripts that people instantly recognize as slop, destroying credibility — the value of this content is the human take, not an AI summary.

Related episodes

Video · a16z Podcast

Software in the Age of Agents | The a16z Show

→

Article · Big Technology

Apple’s lawsuit against OpenAI makes serious claims. Will they matter?

→

Video · Lenny's Podcast

The rise of taste, human authenticity and judgment in an AI world | Adam Mosseri (Head of IG)

→