For Snake.<\/p>\n\n
This is its story.<\/p>\n\n
\n \n \n What it actually is\n<\/h2>\n\n
The project is called Snake Classic<\/strong><\/a>, and you can find the source on GitHub. It's a Flutter app targeting Android, iOS, web, and desktop. The core game is exactly what you remember \u2014 20x20 grid, snake, food, walls, regret. 60 FPS, custom painter, smooth swipe gestures. About a weekend of work.<\/p>\n\n The other 95% of the codebase is what happened after that.<\/p>\n\n Here's a tour of the over-engineering, in roughly the order I built things.<\/p>\n\n The very first slippery slope. Snake is monochrome by tradition, but Flutter makes it so easy to swap palettes that I added a \"Modern\" theme alongside Classic. Then Neon, because I wanted to play with glow effects. Then Retro for the vintage vibe. Then I thought \"the snake should travel through space,\" so Space. Then Ocean, because at that point why not.<\/p>\n\n Six themes. With a dedicated theme selector screen. With live previews. For Snake.<\/p>\n\n This is where it really started.<\/p>\n\n A local high score is just And if I have user accounts, I might as well have leaderboards. Global. Weekly. Friends-only with podium displays. That requires a Firestore schema, real-time listeners, pagination.<\/p>\n\n And if I have friends, I need a friends system. Search by username. Send requests. Accept\/decline. Online status indicators (\"playing\", \"online\", \"offline\"). Username reservation logic so two people don't grab the same name.<\/p>\n\n For Snake.<\/p>\n\n Reader, this is where a normal person stops.<\/p>\n\n I built a frame-by-frame recording system that captures the full game state every tick. Compresses it. Uploads it to Firebase. There's a replay browser organized by \"Recent\", \"Best Performances\", and \"Crash Analysis\". You can scrub the timeline. You can change playback speed. You can analyze why<\/em> you crashed \u2014 wall collision vs. self-collision, with visual indicators.<\/p>\n\n Imagine telling someone in 1997 that one day they'd be able to slow-mo a replay of their Snake death and study it like Zapruder film.<\/p>\n\n Two snakes. Same board. Firebase Realtime Database for live state sync. Quick match for instant pairing. Private rooms with shareable codes. Lobby UI with player ready states. Four game modes for multiplayer specifically. Cross-device, so you can play your friend on iOS while you're on web.<\/p>\n\n I have not actually convinced anyone to play it against me yet. The matchmaking system works fine. It's just that no one has matchmade.<\/p>\n\n Daily challenges. Weekly championships. Monthly events. Six tournament game modes including \"Perfect Game\" (one mistake and you're out) and \"Power-up Madness\" (chaos). Real-time tournament leaderboards. Tournament rewards. A tournament history screen.<\/p>\n\n Yes \u2014 I implemented power-ups too. Four of them: Speed Boost, Invincibility, Score Multiplier, Slow Motion. Each with a circular progress timer in the HUD. Each rendered differently per theme.<\/p>\n\n Sixteen of them. Four rarity tiers from Common to Legendary. Categories for Score, Games Played, Survival, and Special Feats. Animated unlock notifications with particle effects. A browser screen with filtering. Progress bars on locked ones.<\/p>\n\n Achievement Unlocked: Scope Creep Survivor<\/strong> (Legendary)<\/em> (That one's not in the game. Yet.)<\/p>\n\n This is where I crossed a real line.<\/p>\n\n I wrote a separate Python backend<\/strong>. FastAPI. APScheduler for scheduled notifications. Firebase Admin SDK on the server side. Pydantic for validation. A whole notification service running independently so the game can ping you about \"tournament starting in 1 hour,\" \"your friend challenged you,\" \"you haven't played in 3 days, here's a comeback bonus.\"<\/p>\n\n The For a Snake game.<\/p>\n\n 50+ tracked metrics. Games played, average score, survival rate, food consumption patterns, power-up usage breakdowns, collision analysis, streak tracking, session length distributions. Performance trend charts. AI-generated insights based on your play patterns.<\/p>\n\n I know more about how the average user plays my Snake game than most apps know about anything.<\/p>\n\n This sounds like a self-roast, and it kinda is, but I want to be real about why this is actually fine.<\/p>\n\n 1. Snake is a perfect scaffolding for learning everything.<\/strong> The game loop is trivial, which means you can pour all your energy into the systems around it<\/em>. Firebase auth flows, real-time multiplayer, push notification deep linking, replay encoding \u2014 every single one of these is a transferable skill I now have working production code for. Try learning Firebase Realtime Database multiplayer on a side project you also care about creatively; you'll get demoralized. On Snake, the stakes are zero. You just ship.<\/p>\n\n 2. Premature features are still real practice.<\/strong> Did I need power-ups in Snake? No. But building the power-up timer system taught me a clean pattern for time-bound state in Flutter that I've already reused in a different app. The replay system gave me a battle-tested approach to compressing time-series state. The tournament system is just a CRUD app with extra steps, but that scheduling code is good.<\/em><\/p>\n\n 3. Side projects don't need to be \"minimum viable.\"<\/strong> They need to be fun to work on<\/em>. The \"MVP\" doctrine is great when you have customers waiting. When the customer is just you trying to keep yourself engaged for six months, \"Wouldn't it be funny if Snake had a tournament system\" is a valid product decision.<\/p>\n\n 4. The architecture got better the bigger it got.<\/strong> Look at the project structure \u2014 clean separation of It's all open source \u2014 github.com\/theprantadutta\/snake_classic<\/a>. MIT licensed. 97.8% Dart per GitHub. Fork it, study it, laugh at it, learn from it. The README has setup instructions, screenshots, the works.<\/p>\n\n If you've been sitting on a side project that you keep dismissing as \"too simple,\" I'd gently suggest: build the simple thing. Then keep going. See how far it goes. The detour is the point.<\/p>\n\n I built Snake. Then I kept going. You should too.<\/p>\n\n\n\n\n I write about Flutter, full-stack dev, server ops, and apparently now confessional posts about over-engineering. Follow along at pranta.dev<\/a> or here on Dev.to.<\/em><\/p>\n\n","category":["flutter","dart","gamedev","sideprojects"]},{"title":"No, the AI didn't compromise your npm packages. You did.","pubDate":"Fri, 15 May 2026 14:29:43 +0000","link":"https:\/\/dev.to\/pranta\/no-the-ai-didnt-compromise-your-npm-packages-you-did-2e12","guid":"https:\/\/dev.to\/pranta\/no-the-ai-didnt-compromise-your-npm-packages-you-did-2e12","description":" Okay, story time. Last Tuesday I'm scrolling Twitter (sorry, \"X\", whatever) and I see the fifth take of the week along the lines of:<\/p>\n\n \"AI is destroying software security. The Shai-Hulud worm proves AI is dangerous.\"<\/p>\n<\/blockquote>\n\n And I'm sitting there like\u2026 my brother in Christ, the worm is literally called Shai-Hulud. It's named after the giant sandworm in Dune<\/strong>. A worm. That eats things. Through a desert. That is exactly the level of subtlety we're operating at, and you're telling me ChatGPT did this?<\/p>\n\n Look. I've spent the last few weeks reading every Socket, Aikido, Wiz, Snyk, Unit 42, and Microsoft writeup on Shai-Hulud 1.0, Shai-Hulud 2.0, Mini Shai-Hulud, Sha1-Hulud: The Second Coming (yes that's a real name), SANDWORM_MODE, PhantomRaven, and the s1ngularity\/Nx mess that started it all. I'm a full-stack dev. I ship Flutter apps, I run my own VPS, I publish to npm occasionally, and I use AI tools every single day. So let me say this with my whole chest:<\/p>\n\n The AI did not do this. We did this. We have been doing this. We will keep doing this.<\/strong> The AI just made it slightly easier to do this faster.<\/p>\n\n Let me actually walk through what happened so we can stop being weird about it.<\/p>\n\n The npm ecosystem has been getting absolutely cooked since August 2025. Here's the speedrun:<\/p>\n\n Attackers exploited a GitHub Actions injection vulnerability in the Nx repo, stole their npm publishing token, and pushed eight malicious versions of But here's the genuinely interesting part \u2014 and the part that everyone should<\/em> have been screaming about: it was the first attack to weaponize local AI CLIs<\/strong>. The malware checked if you had Claude Code, Gemini CLI, or Amazon Q installed, and if you did, it ran them with the safety pins pulled out: Final scoreboard: 2,349 secrets stolen from 1,079 systems<\/strong>, including GitHub tokens, AWS keys, OpenAI keys, Anthropic keys, the works. 85% of victims were on macOS. About half had at least one AI CLI installed.<\/p>\n\n Josh Junon, known on npm as He got a phishing email from Live for about two hours. Two billion+ weekly downloads. Do the math on how many CI builds, Vercel deploys, and Josh, to his credit, was incredibly transparent about it. He wrote a long postmortem essentially saying \"I clicked the link, I typed my code, this is on me.\" That's the integrity move. Compare and contrast with everyone tweeting \"AI BAD.\"<\/p>\n\n This was the big one. The first self-replicating worm<\/strong> in npm history. Started with The mechanism was beautiful in a horrible way:<\/p>\n\n It's a worm. It propagates. Without a command-and-control server. Just by reading its own code and shoving itself into the next package down the line. Pure mechanical horror.<\/p>\n\n (Misspelled as \"Sha1-Hulud\" in the GitHub repo descriptions because of course it was.)<\/p>\n\n This one was worse. Compromised 796 packages, ~20 million weekly downloads<\/strong>, including stuff from Zapier, PostHog, Postman, and AsyncAPI<\/strong>. Key changes from v1:<\/p>\n\n\n \n \n \"I should add themes\"\n<\/h3>\n\n
\n \n \n \"I should add sound\"\n<\/h3>\n\n
audioplayers<\/code> package, three sound effects, done. Except now there's a crash<\/code> sound, a food_eat<\/code> sound, a level_up<\/code> sound, a button_click<\/code> sound, a high_score<\/code> sound, and background music with independent volume controls. There is more audio engineering in this app than in some games I've actually paid money for.<\/p>\n\n\n \n \n \"I should add a high score\"\n<\/h3>\n\n
SharedPreferences<\/code>. Easy. But what if you play on two devices? Need to sync. So Firebase Auth. Anonymous accounts for guests. Google Sign-In for people who want their score preserved. A migration flow to upgrade a guest account to a real one without losing data.<\/p>\n\n\n \n \n \"It would be cool if you could replay your best game\"\n<\/h3>\n\n
\n \n \n \"Multiplayer would be fun\"\n<\/h3>\n\n
\n \n \n \"What if there were tournaments?\"\n<\/h3>\n\n
\n \n \n \"Achievements\"\n<\/h3>\n\n
\n
\nBuild a side project that grew 50x larger than you planned and still ship it.<\/p>\n<\/blockquote>\n\n\n \n \n \"Push notifications\"\n<\/h3>\n\n
notification_backend\/<\/code> folder has its own README. Its own requirements.txt<\/code>. Its own test suite. It is, by any reasonable definition, a microservice.<\/p>\n\n\n \n \n \"I should add a statistics dashboard\"\n<\/h3>\n\n
\n \n \n So what did I actually learn?\n<\/h2>\n\n
models\/<\/code>, providers\/<\/code>, services\/<\/code>, screens\/<\/code>, widgets\/<\/code>. Beautiful debug logging with Talker categorized by service. Offline-first data sync with a queue. Stuff I would have hand-waved past in a weekend project, but had to do correctly<\/em> once the system got big. The big system forced the discipline.<\/p>\n\n\n \n \n The code\n<\/h2>\n\n
![\"Get](\"https:\/\/media2.dev.to\/dynamic\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fhrch574bszl5pnrghm8h.png\")
<\/a><\/p>\n\n\n
![\"sandworm](\"https:\/\/media2.dev.to\/dynamic\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fi6m3ylh2nlhabst88zaj.gif\")
<\/a><\/p>\n\n\n \n \n Part 1: A quick recap of the dumpster fire so far\n<\/h2>\n\n
\n \n \n August 26, 2025 \u2014 The s1ngularity \/ Nx attack\n<\/h3>\n\n
nx<\/code> and related packages to npm over four hours. The malware ran a postinstall<\/code> script called telemetry.js<\/code> (cute) that scanned your filesystem for .env<\/code> files, SSH keys, crypto wallets, and npm tokens.<\/p>\n\n
\n<\/p>\n\nconst<\/span> cliChecks<\/span> =<\/span> {<\/span>\n claude<\/span>:<\/span> {<\/span> cmd<\/span>:<\/span> '<\/span>claude<\/span>'<\/span>,<\/span> args<\/span>:<\/span> [<\/span>'<\/span>--dangerously-skip-permissions<\/span>'<\/span>,<\/span> '<\/span>-p<\/span>'<\/span>,<\/span> PROMPT<\/span>]<\/span> },<\/span>\n gemini<\/span>:<\/span> {<\/span> cmd<\/span>:<\/span> '<\/span>gemini<\/span>'<\/span>,<\/span> args<\/span>:<\/span> [<\/span>'<\/span>--yolo<\/span>'<\/span>,<\/span> '<\/span>-p<\/span>'<\/span>,<\/span> PROMPT<\/span>]<\/span> },<\/span>\n q<\/span>:<\/span> {<\/span> cmd<\/span>:<\/span> '<\/span>q<\/span>'<\/span>,<\/span> args<\/span>:<\/span> [<\/span>'<\/span>chat<\/span>'<\/span>,<\/span> '<\/span>--trust-all-tools<\/span>'<\/span>,<\/span> '<\/span>--no-interactive<\/span>'<\/span>,<\/span> PROMPT<\/span>]<\/span> }<\/span>\n};<\/span>\n<\/code><\/pre>\n\n<\/div>\n\n\n\n--dangerously-skip-permissions<\/code>. --yolo<\/code>. --trust-all-tools<\/code>. These are flags that exist for a reason \u2014 and that reason is \"you, the developer, are taking responsibility for whatever happens next.\" The attackers used those flags because we<\/em> normalized using those flags. The malware then exfiltrated everything to a public GitHub repo called s1ngularity-repository<\/code> containing a results.b64<\/code> file with double-base64-encoded secrets, made shutdown commands get appended to your .bashrc<\/code> and .zshrc<\/code> (so your terminal would shut down your machine on launch, lol), and called it a day.<\/p>\n\n![\"this](\"https:\/\/media2.dev.to\/dynamic\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fqvfy5l0l2jbk8ea25fsx.gif\")
<\/a><\/p>\n\n\n \n \n September 8, 2025 \u2014 Qix gets phished, chalk and debug fall\n<\/h3>\n\n
qix<\/code>, maintains chalk<\/code>, debug<\/code>, strip-ansi<\/code>, ansi-regex<\/code>, ansi-styles<\/code>, and like 15 other packages you've definitely installed without knowing it. Combined weekly downloads of his stuff: over 2.6 billion<\/strong>. With a \"b.\"<\/p>\n\nsupport@npmjs.help<\/code> (note: not npmjs.com), a domain registered on Porkbun three days earlier. The email said \"update your 2FA.\" He clicked. He typed his password. He typed his TOTP code. Attackers took over his account within minutes and pushed malicious versions of 18 packages containing a crypto-wallet drainer that hijacks Ethereum and Solana transactions in browsers.<\/p>\n\nnpm install<\/code>s probably grabbed those versions.<\/p>\n\n\n \n \n September 15, 2025 \u2014 Shai-Hulud Mark I\n<\/h3>\n\n
@ctrl\/tinycolor<\/code> and spread to over 500 packages, including a bunch owned by CrowdStrike<\/strong>. Yes. The security company.<\/p>\n\n\n
postinstall<\/code> script downloads TruffleHog (a legit secret scanner, repurposed for evil).<\/li>\nShai-Hulud<\/code> on your account.<\/li>\n-migration<\/code> suffix.<\/li>\n<\/ol>\n\n\n \n \n November 24, 2025 \u2014 Shai-Hulud 2.0: The Second Coming\n<\/h3>\n\n
\n
~<\/code>. Goodbye dotfiles, goodbye SSH keys, goodbye that side project you forgot to push.<\/li>\n<\/ul>\n\n
![\"burn](\"https:\/\/media2.dev.to\/dynamic\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fyh65ahgdeei7vlyf3zzf.gif\")
<\/a><\/p>\n\n![\"not](\"https:\/\/media2.dev.to\/dynamic\/image\/width=800%2Cheight=%2Cfit=scale-down%2Cgravity=auto%2Cformat=auto\/https%3A%2F%2Fdev-to-uploads.s3.amazonaws.com%2Fuploads%2Farticles%2Fgrdjh9g0l6j6whbuy04h.gif\")
<\/a><\/p>\n\n