Dev Weekly: Nvidia's Mystery Customers, Meta Ditches Scale AI and Nx Supply chain attack

This week brought critical security news and major AI industry developments that every developer needs to know:

🚨 CRITICAL: Nx Build Tool Supply Chain Attack

The biggest security story this week: Malicious packages infiltrated the popular Nx build system ecosystem, affecting thousands of JavaScript/TypeScript projects worldwide.

What Happened:

Attackers published weaponized AI-generated malware to npm packages
Core Nx packages (@nx/core, @nx/devkit) were compromised with malicious code
Designed to steal environment variables, API keys, and cryptocurrency wallet data
Specifically targeted development environments and CI/CD pipelines

Immediate Action Required:

# Check if you're affected
npm ls @nx/core @nx/devkit
# Update to verified safe versions
npm update @nx/core @nx/devkit
# Rotate any potentially compromised credentials

*Source: Snyk Security Research

The Register*

🏢 Nvidia’s Revenue Concentration Problem

This week’s earnings revealed something concerning: just two customers account for 39% of Nvidia’s $30B quarterly revenue. While unnamed, they’re likely Microsoft and Meta.

Why this matters for developers:

Supply chain risk: Customer changes could impact chip availability
Pricing volatility: Concentrated demand affects GPU costs
Planning: Consider diversifying AI infrastructure beyond CUDA-only solutions

🔐 WhatsApp Zero-Click Exploit Fixed

WhatsApp patched a critical vulnerability allowing remote code execution through malicious media files - no user interaction required.

Technical Details:

Memory corruption in media processing pipeline
Exploitable through specially crafted images
Affected both mobile and desktop versions

For Developers:

Audit your media handling code for similar vulnerabilities
Implement robust input validation for file uploads
Consider sandboxing media processing operations

🛠️ Essential Platform Updates

GitHub Copilot Enhancements:

Model Context Protocol (MCP) server support
Custom instructions via AGENTS.md files
Better VS Code integration

Security & Infrastructure:

Azure MFA enforcement rolling out
Docker 30% performance improvements
Enhanced secret scanning across platforms

🎯 Security Action Items

The Nx attack shows AI-generated malware is becoming sophisticated enough to evade detection. Supply chain security is now critical infrastructure.

Essential Actions:

Pin critical dependencies to specific versions
Regular dependency audits (npm audit, yarn audit)
Monitor lockfiles for unexpected changes
Implement dependency approval workflows

🏢 Nvidia’s Revenue Concentration Problem

This week’s earnings revealed something that should worry both Nvidia and the broader AI ecosystem: just two customers account for 39% of their revenue. While Nvidia won’t name them, industry watchers suspect they’re likely Microsoft and Meta, given their massive AI infrastructure investments.

Why this matters for developers:

Supply chain risk: If these customers reduce orders, it could impact chip availability
Pricing power: Heavy concentration gives large customers more negotiating leverage
Competition concerns: Smaller AI companies might struggle to get priority access to the latest chips

The revelation highlights how the AI boom has created winner-take-all dynamics that could shape the entire industry’s future.

Meta’s Scale AI Breakup

The partnership between Meta and Scale AI, once held up as a model for AI data collaboration, is showing serious strain. Sources report disagreements over data quality, pricing, and strategic direction.

What’s happening:

Scale AI was supposed to help Meta label and clean training data
Quality issues and missed deadlines have frustrated Meta’s AI teams
Both companies are reportedly exploring other partnerships

This matters because it shows how hard it is to scale AI data operations, even with dedicated companies focused on the problem. If Meta and Scale can’t make it work smoothly, what does that say about smaller companies trying to build their own AI systems?

🛡️ Security & Privacy

WhatsApp’s Zero-Click Nightmare

WhatsApp fixed a critical vulnerability that allowed attackers to install spyware on Apple devices without any user interaction. The bug was actively exploited in the wild, targeting journalists and activists.

Technical details:

Attackers could send malicious media files that triggered the exploit
No user interaction required - just receiving the message was enough
Affected iOS devices running specific WhatsApp versions
Patch rolled out automatically to most users

TransUnion Data Breach Hits 4.4M Users

The credit reporting agency confirmed hackers stole personal information from 4.4 million customers. The breach included names, addresses, phone numbers, and partial credit information.

FBI: China’s Salt Typhoon Compromised 200+ US Companies

The FBI revealed that Chinese hackers have infiltrated at least 200 US companies using sophisticated supply chain attacks. The campaign targeted software vendors to gain access to their customers’ networks.

This reinforces why supply chain security should be a top priority for any company. Trust but verify applies to every dependency in your stack.

🛠️ Developer Tools & Platforms

GitHub Copilot Gets Smarter Models

GitHub published a deep dive into the AI models powering Copilot, revealing their multi-model approach and how they’re optimizing for different coding tasks.

Key insights:

Different models handle different types of coding tasks
Specialized models for specific languages and frameworks
Infrastructure designed for sub-second response times
Focus on agentic workflows where AI completes entire features

The post gives fascinating insight into how GitHub thinks about AI model selection and deployment at scale.

JetBrains Copilot Integration Improves

GitHub Copilot’s “next edit suggestion” feature is now in public preview in JetBrains IDEs. This brings more of Copilot’s intelligence directly into IntelliJ IDEA, PyCharm, and other JetBrains tools.

What’s new:

Predictive code suggestions based on your editing patterns
Better integration with JetBrains’ code analysis tools
Support for multi-file refactoring suggestions

MCP Server Development Gets Easier

GitHub published an updated guide for building Model Context Protocol servers, making it easier for developers to extend AI tools with custom capabilities.

Why MCP matters: Instead of waiting for AI tools to support your specific use case, you can build custom extensions that give AI models direct access to your APIs, databases, and workflows.

Raycast + GitHub Copilot Integration

You can now start and track GitHub Copilot coding agent tasks directly from Raycast. This makes it even easier to delegate coding work to AI while staying in your workflow.

📱 Platform Updates

TikTok Adds Voice Messages and Images to DMs

TikTok finally caught up with other messaging platforms by adding voice notes and image sharing to direct messages. The update also includes new privacy controls for who can send you messages.

Developer angle: The feature rollout shows how platform companies are still playing catch-up with basic messaging features, despite their AI advances. Sometimes the simplest features take the longest to ship.

Threads Tests Long-Form Content

Meta’s Twitter competitor is testing ways to share longer text content on the platform. The feature could help Threads compete with platforms like Medium and Substack for longer-form content.

WhatsApp’s AI Message Rephrasing

WhatsApp rolled out an AI feature that lets you rephrase and adjust the tone of your messages before sending them. The feature works locally on your device for privacy.

Technical insight: Local AI processing is becoming the norm for privacy-sensitive features. This trend will continue as on-device AI capabilities improve.

🏗️ Infrastructure & Cloud

GitHub’s WebP Image Support

GitHub now supports WebP images across the platform, including in README files, issues, and pull requests. This should improve page load times and reduce bandwidth usage.

Why developers care: WebP offers better compression than PNG and JPEG while maintaining quality. Native platform support makes it easier to optimize your project documentation.

Copilot Agent Custom Instructions

GitHub Copilot coding agent now supports AGENTS.md files for custom instructions. This lets you give the AI context about your project’s coding standards, architecture decisions, and preferences.

How to use it:

Create an AGENTS.md file in your repository root
Include coding standards, architecture notes, and project-specific guidance
Copilot agents will automatically use this context when working on your code

This is a game-changer for teams that want consistent AI assistance across their codebase.

🧠 AI & Machine Learning Developments

The State of AI Model Diversity

This week highlighted the growing importance of model diversity in AI applications. From GitHub’s multi-model approach to WhatsApp’s local AI features, companies are realizing that one model doesn’t fit all use cases.

Emerging patterns:

Local models for privacy-sensitive features
Specialized models for specific programming languages
Hybrid approaches combining multiple models for better results
Edge deployment becoming more common

Anthropic Settles Book Training Lawsuit

Anthropic reached a settlement with authors over using their books to train AI models. While terms weren’t disclosed, the settlement suggests companies are taking copyright concerns more seriously.

Impact for developers: This could influence how AI companies source training data and might lead to more transparent data usage policies.