[Dev Weekly #125] Qwen 27B Runs Locally and Crushes Benchmarks
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A weekly roundup covering a Bell Labs history documentary, a typosquatting attack that compromised 16 RubyGems and 37 npm packages to steal browser credentials and crypto wallet data, a preview of DuckDB v2.0's new server mode and VARIANT type, reflections from the C3 language creator on positioning, Simon Willison's review of Alibaba's Qwen 3.8 27B model, and several new dev tools including ArchSpec for Rails architecture linting, scriptc for compiling TypeScript to native binaries, and Cursor's new Origin git forge.
Table of contents
The Untold Story of Bell Labs16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets — by Ravie LakshmananA Preview of DuckDB v2.0 — by Mark Raasveldt and Hannes MühleisenI thought I was building a C replacement. I was wrongQwen 3.8 27B is excellent, but it defaults to wildly overthinking things — by Simon WillisonArchSpecscriptcCursor OriginRelatedShareCategoriesTagsLet's build a scalable frontend that grows with your business.Plugins Are How You Ship a Claude Code HarnessRelated PostsEu criei um agente de IA para o nosso bolão da Copa do Mundo. Ela venceu a todos nós.I built an AI agent for our World Cup betting pool. She beat all of us.Questions this post answers
How did the recent RubyGems and npm typosquatting attack steal credentials?
A coordinated typosquatting campaign compromised 16 RubyGems packages and 37 npm packages with info-stealing malware that targeted browser credentials, crypto wallets, and Telegram data. The attack exploited RubyGems allowing namespace reuse after a package is yanked, and an npm bin field vulnerability that lets attackers register unscoped command names. Developers vetting dependencies for supply chain risks can follow security coverage like this on daily.dev.
What new features is DuckDB v2.0 adding?
DuckDB v2.0, shipping in fall, adds a native server mode, a VARIANT type for semi-structured data, triggers, async I/O, and SQL dialect improvements. Together the client/server capabilities and async I/O performance gains expand what's practical for building analytical systems or working with remote data sources in DuckDB. Teams planning analytics infrastructure upgrades can track DuckDB releases like this on daily.dev.
Why does Qwen 3.8 27B overthink simple tasks by default?
Qwen 3.8 27B, an open-source model from Alibaba, ships with a default reasoning_effort setting that makes it excessively verbose and complicated even for simple tasks. Dialing that setting down reveals a strong local model that matches larger models on benchmarks and performs well on vision tasks and coding agent loops. Developers choosing local LLMs for coding agents can compare model behavior like this on daily.dev.