I appreciate them since it’s free but yeah

(Latest system prompt: 25/03/2025)

I managed to get FULL official v0, CURSOR AI AGENT, Manus and Same.dev system prompts and AI models info. Over 5k lines

Check it out at: https://github.com/x1xhlol/system-prompts-and-models-of-ai-tools

Apart from the crazy prices at Vercel, why does their CEO feel it’s necessary to sprinkle in a little genocide too?

i've been hacked

and traced the malware's wallet to see how much money they actually made from this new exploit

(if you use Next.js/React, READ THIS!)

I woke up to a terrifying email from Hetzner: "Netscan Detected."

my server was blocked and a botnet was using my IP to attack others

i dug into the logs and what I found the anatomy of the attack:

1. The Symptoms: I logged into htop and saw the mess:

- CPU usage: 361%
- A process named ./3ZU1yLK4 running wild
- Random connections to an IP in the Netherlands

my server wasn't serving my app anymore; it was mining crypto for someone else!

2) The Culprit: It wasn't a random SSH brute force. It was inside my Next.js container

the malware was sophisticated

it renamed itself nginxs and apaches to look like web servers

it even had a "killer" script that hunted down other hackers' miners to kill the competition

3) The "Root" Cause (literally): Probably the recent React/Next.js CVE-2025-66478 exploit was the entry point

(my project was running on "next": "15.5.4", behind cloudflare dns, but their recent fix didn't work apparently)

but the fatal error was mine: my Docker container was running as ROOT

Coolify deploys like this automatically when using Nixpacks, and I never changed it...

so because of USER root, the malware could install cron, systemd, and persistence scripts to survive reboots

meaning, it was able to infect my whole server, from a single Next.js docker!

4) The Forensics: I ran docker diff on the container - the hacker didn't just run a script, they installed a whole toolset..

- /tmp/apaches.sh (The installer)
- /var/spool/cron/root (The persistence)
- /c.json (The wallet config)

5) The Fix: I killed the container, scrubbed the host, and extracted the malware for analysis.

but the real fix is in the Dockerfile. if you are deploying Node/Next.js, DO NOT use the default (root), you must:

- RUN adduser --system nextjs
- USER nextjs

if you have Docker on ROOT and didn't update the exploited react version, you'll be hacked soon

check your containers NOW. Run: docker exec <container_id> id

(or get the full list first: docker stats --no-stream)

If it says uid=0(root), you are one vulnerability away from being a crypto-miner host.

(it's easy to notice when hacked, it will be a command running on the top CPU%, using all your hardware resources)

6) The Money: I dug deeper and recovered the config file (c.json)

- Wallet: A Monero (XMR) address: 831abXJn8dBdVe5nZ***
- Pool: auto.c3pool . org

and ofc i tracked the hacker’s wallet on the mining pool

7) The Scale: My server wasn't alone. It was just 1 of 415 active zombies in this botnet

they are burning the CPU of 400+ cloud servers... to earn...

guess how many millions?

$4.26/day

on the image attached you can see: "Total Paid: 0.00", meaning this campaign just started. I caught them on Day 1.

i also tracked back the server where they hosted the malware, and by inspecting the code, I found several comments in Chinese, so I guess that's their origin

im rebuilding from scratch on a fresh VPS. the lesson was expensive, but at least I caught it before the hosting nuked my account permanently...

PS: I have the IP for all the other machines mining with that malware, not sure how I can help them, but feel free to contact me if ur doing infosec

stay safe

images here: https://x.com/duborges/status/1997293892090183772?s=20

I'm sorry but I have to rant about this. I am so sick and tired of these 5-6-10 hour long nextJS "tutorials" and "courses" that keep preaching and teaching the use of paid services for literally EVERYTHING - from basic database usage, to authentication , to caching etc.

What happened to actual development as in finding solutions to problems by using your brain and not your wallet.

New devs probably think "..geez auth is so easy, you just install Clerk and put a context provider around your app and you're ready to go".. or "websockets are so easy, you just sign up to pusher and a few lines of code later you have yourself a setup WebSocket server".

We are doing ourselves an extreme disservice by wrongfully teaching people that this is what programming is. Those are the people that one day we'll have to manage, and those are the people that are supposed to push software forward.

Dear programming "influencers" and "gurus" - Please stop.

edit: After reading a lot of the comments I'm starting to understand that a lot of people's goal is not to become good software engineers / programmers, but to ship products as fast as possible. I guess it was my mistake for assuming that the majority of people want to obtain actual skills, and if all you care about is shipping a "product" at all costs without caring about the product's robustness and the cost of running it feel free to ignore my post completely.

edit2: A lot of people seem to be conflating the usage of libraries and the usage of paid services. I'm in no way saying that people shouldn't use auth libraries, ORMs etc, what I was specifically referring to is the over-abstracted services thay have the "pay-as-you-scale" model and create a forced dependancy. You can always use a library (even an old version of one) , but if a service provider decides to 5x your bill or if they go bankrupt, you're going to have to redo a huge portion of your app.

Thankfully I don’t have any sorta financial / private info on my server 🫣

take a look

https://www.rockstargames.com/VI

This was at the top of my feed just now - Mastra Cloud left Nextjs for performance reasons and now use Vite. T3 Chat moved to Tanstack Start.

How do you all handle this? It’s hard to distinguish pages at a glance in editor tabs, fit diffs, etc.