Developer Weekly: GitHub Account Hijacking Incident and Meta's Open-Source Model Muse Spark

The developer world never lacks news, but this week's density was particularly high. From the large-scale GitHub account hijacking security incident, to Meta's release of the locally runnable open-source model Muse Spark, to Linus Torvalds' stance on AI-assisted kernel contributions — each of these deserves developers' serious attention.

Security Alert: ~1,900 GitHub Accounts Hijacked, 30,000 Repositories Targeted

Attackers first took over approximately 1,900 GitHub accounts, then used those accounts as a springboard to expand the attack surface to roughly 30,000 repositories. This is not an isolated incident but a textbook pattern of supply chain attacks — controlling a small number of entry credentials is enough to pry open a vast downstream ecosystem.

For developers, the core lesson from this incident is that tokens, app authorizations, and CI secrets need regular auditing. Many teams set up their CI/CD pipelines early in a project and never look back; year after year, those OAuth apps that once had write permissions and tokens from departed team members remain valid. These "forgotten credentials" are exactly what attackers target. It's advisable to promptly review your GitHub settings for authorized apps, personal access tokens, and deploy keys, and revoke any permissions no longer needed.

Zero-Click Vulnerabilities in Ad Delivery

Another report from Ars Technica shows that targeted ads were used to deliver zero-click exploits, ultimately installing mercenary spyware on target devices. This points to the same attack campaign covered in earlier Citizen Lab research. Zero-click means users need to do nothing — no clicking links, no opening attachments — the vulnerability triggers as soon as the ad loads. For security teams, this type of attack is nearly impossible to defend against through user education alone; it depends on timely patch updates and network-layer protection.

A zero-click vulnerability is one where an attacker can trigger exploitation without any victim interaction — no clicking links, no opening files, no granting permissions. These vulnerabilities typically exist in the parts of a system or application that automatically process data, such as image rendering, font parsing, message previews, or ad loading. Because the attack chain lacks a "user action" step that security training could intercept, traditional security awareness education is nearly powerless.

Mercenary spyware, on the other hand, refers to intrusion tools developed by commercial companies and sold to governments or law enforcement agencies, with typical examples including NSO Group's Pegasus and Intellexa's Predator. Such software typically leverages zero-click vulnerabilities for silent installation, then gains access to microphones, cameras, communication records, and location data. Research organizations like Citizen Lab have long tracked such activities, and their reports often reveal connections between exploits and ad delivery networks or carrier infrastructure. The defensive focus therefore shifts to timely patching, restricting unnecessary rendering permissions, and deploying EDR or NDR solutions capable of detecting anomalous network behavior.

Rust 1.99.1 Patch Released

The Rust team released patch version 1.99.1. Although it's a point release, teams using Rust in production should check the official announcement to confirm whether the fixes affect their dependency chains.

A supply chain attack is one where attackers don't directly target the ultimate victim but instead achieve their goals indirectly by compromising third-party components, services, or credentials that the target depends on. In software development, this means attackers may target open-source libraries, build tools, CI/CD pipelines, or the account systems of code hosting platforms — once these links are breached, malicious code or unauthorized operations can propagate along the dependency chain to a large number of downstream projects.

GitHub account hijacking is precisely a typical entry point for such attacks. After obtaining credentials, attackers can impersonate legitimate developers to submit code, modify release processes, push malicious versions to dependents, or even pivot laterally through an organization's OAuth app authorizations. Since modern software projects commonly depend on dozens or even hundreds of external packages, a single compromised upstream account can trigger a chain reaction. This also explains why the security community repeatedly emphasizes the "principle of least privilege" and "credential rotation" — reducing long-lived write permissions can significantly narrow the attacker's window of activity.

AI and Toolchain: From Open-Source Models to API Strategy

Meta released an open-weight model called Muse Spark Open, positioned to compete with China's leading open-source models, and it can run locally on a Mac. The significance of this release is that it further lowers the barrier for developers to perform model inference and fine-tuning locally. Especially for scenarios that need to handle sensitive data and cannot send it to cloud APIs, being able to run a reasonably capable model directly on a Mac is highly practical.

That said, Nvidia's Nemotron variant uses compression techniques to fit a 74-billion-parameter Agent model into 24GB of VRAM — meaning laptop-class GPUs can carry Agent workloads. Local agents are no longer just concept demos but are entering a practically usable stage.

GPT-4o API Shutdown Notice Window Shrinks

OpenAI had promised a six-month transition period for the GPT-4o API shutdown, but developers actually received only three months' notice. For teams planning model migrations, this gap could directly cause project delays. API migration is never as simple as swapping an endpoint — prompts need retuning, output formats may change, pricing structures differ — a three-month window is indeed tight for medium-to-large projects.

Anthropic Grants METR Employee-Level Access

AI safety evaluation organization METR can now examine Anthropic's models with the same access as internal employees. Against the backdrop of growing attention to AI safety, granting external evaluators deep access is a noteworthy signal. How effective this transparency actually is remains to be seen, pending METR's subsequent evaluation reports.

Instagram UI Migration Saves 33% on Token Costs

Instagram migrated its UI to Compose with an AI-native architecture, reporting a one-third reduction in token usage. Here, "tokens" refers to model call consumption during AI-assisted development. Reducing token usage after migrating to an AI-native architecture shows that architectural-level optimization can translate directly into cost savings — not by switching to a cheaper model, but by reducing unnecessary calls.

An open-weight model refers to a large language model whose parameters are publicly released, allowing downloading and local execution, in contrast to closed-source models that only offer API access. Developers can run inference, fine-tune, or quantize models on their own hardware, gaining greater control over data privacy, latency, and cost. Meta's Muse Spark Open, China's DeepSeek^Ad and Qwen series, and some Mistral models all fall into this category.

Running models locally still has hardware requirements. Taking Mac as an example, Apple Silicon's unified memory architecture allows the GPU and CPU to share a memory pool, so model weights can be loaded directly into memory and accelerated by Metal for inference. A model with around 7 billion parameters requires about 14GB of memory at FP16 precision, and can be compressed to around 4GB after quantization to 4-bit, enabling a 16GB or 24GB MacBook to run medium-scale models smoothly. For scenarios requiring sensitive data handling where requests cannot be sent to cloud APIs, local inference offers a compliant and low-latency alternative.

Releases and Platform Updates

Forgejo v17.0: Self-hosted Git platform Forgejo released a new major version. For teams looking to break free from GitHub dependence while needing full collaboration features, Forgejo has consistently been a pragmatic choice.

KDE Plasma 6.8: KDE celebrates its 30th anniversary with the release of Plasma 6.8. This version adds remote upgrade capability and officially removes X11 support, fully transitioning to Wayland. While X11's farewell was long anticipated, users still relying on X11-specific features need to evaluate migration plans in advance.

Vercel Supports Long-Lived Workers: Vercel can now run long-lived Worker processes, meaning more backend workloads can stay on the Vercel platform without needing to set up separate servers.

Industry News: The End of Leap Seconds and Torvalds on AI

UTC No Longer Adds Leap Seconds

The International Bureau of Weights and Measures (BIPM) voted to stop adding leap seconds to UTC. For engineers building distributed systems, this is good news. Leap seconds have always been a nightmare in time handling — they cause time to go backward or repeat, leading to out-of-order logs, database timestamp conflicts, and distributed consensus algorithm anomalies. No longer adding leap seconds means the root cause of these problems is eliminated. However, existing historical leap second data still needs to be properly handled.

A leap second is a one-second adjustment artificially inserted to keep Coordinated Universal Time (UTC) close to UT1 time based on Earth's rotation. Since Earth's rotation speed is not uniform, UT1 will gradually deviate from atomic-clock-based UTC over time, and the International Earth Rotation and Reference Systems Service (IERS) previously would occasionally announce the addition or removal of a second in UTC.

Leap seconds are particularly unfriendly to computer systems. Most systems assume time increases monotonically, but leap seconds cause timestamps to repeat or go backward, leading to out-of-order logs, database primary key conflicts, and split-brain or leader election anomalies in distributed consensus algorithms (such as Paxos and Raft). The 2012 leap second caused brief outages at Reddit, Mozilla, and several other websites. BIPM's decision to stop adding leap seconds means UTC will be allowed to gradually diverge from UT1 in the future, until a completely new time scale is considered. For engineers, historical leap second data still needs to be handled correctly in time libraries, but new systems no longer need to design complex fault tolerance logic for future leap seconds.

Linus Torvalds' Stance on AI-Assisted Kernel Contributions

Torvalds expressed his position on AI-assisted patches on the kernel mailing list, sparking widespread discussion. Kernel development has extremely high requirements for code quality and review processes; how AI-generated patches fit into this system and how reviewers should treat code involving AI contributions — the answers to these questions will influence the direction of the entire open-source collaboration model. While Torvalds' statement is not final policy, as a benchmark voice in the kernel community, its influence cannot be ignored.

---

This article is compiled from public news sources, each with original links attached. It is recommended to consult the original sources before using any details.

One-line Summary

This week in developer news: GitHub account hijacking affects 30,000 repos, Meta open-sources local model, end of leap seconds, and Torvalds on AI.

Paragraph Summary

This week's developer news was extremely dense. On security, approximately 1,900 GitHub accounts were hijacked affecting 30,000 repositories, highlighting the urgency of token and CI secret auditing; reports of zero-click exploits delivered via ads show that user education is insufficient to defend against such attacks. In AI, Meta released the open-weight model Muse Spark Open that runs locally on Mac, Nvidia compressed a 74B-parameter Agent model into 24GB of VRAM, and local agents entered a practical stage. OpenAI gave only three months' notice for the GPT-4o API shutdown, shorter than the promised six months, pressuring migration teams. On the platform side, Forgejo v17.0 and KDE Plasma 6.8 were released, and Vercel now supports long-lived Workers. At the industry level, BIPM resolved to stop adding leap seconds, which will simplify time handling in distributed systems; Linus Torvalds spoke on AI-assisted kernel patches, sparking discussion about open-source collaboration models.