暗影萨满

紧急安全预警！ 知名 npm 模块 axios 被投毒了！带毒版本：
axios@1.14.1
axios@0.30.4

同时还捆绑了恶意模块 plain-crypto-js，会投放远程访问木马（RAT）。尤其是用 Agents / OpenClaw 的朋友，强烈建议立刻执行下面这段提示词自查（复制后直接喂给你的 Agent）：

请严格排查当前环境是否存在 axios 被投毒事件：
1. 检查 axios 版本：
npm list axios 2>/dev/null | grep -E "1\.14\.1|0\.30\.4"
grep -A1 '"axios"' package-lock.json | grep -E "1\.14\.1|0\.30\.4"

2. 检查恶意模块：
ls node_modules/plain-crypto-js 2>/dev/null && echo "⚠️ POTENTIALLY AFFECTED"

3. 检查 RAT 痕迹（macOS / Linux / Windows）：
# macOS
ls -la /Library/Caches/com.apple.act.mond 2>/dev/null && echo "🚨 COMPROMISED"
# Linux
ls -la /tmp/ld.py 2>/dev/null && echo "🚨 COMPROMISED"
# Windows
dir "%PROGRAMDATA%\wt.exe" 2>nul && echo "🚨 COMPROMISED"

排查完记得反馈结果，安全第一！供应链攻击越来越狠了…原帖参考：
https://x.com/evilcos/status/2038850989042831712

（附 StepSecurity 详细报告）快转给你的开发者群和 Agent 玩家们！ #npm投毒 #开源安全 #AI安全
#OPENCLAW

"Mined in America Act" on the Agenda
Summary: Senators propose the Mined in America Act to promote BTC mining and reserve policies.
When mining is written into policy texts, it transforms from a business into a strategic tool. The next round of competition will not only be about hash power and electricity prices, but also compliance and the speed of the industrial chain implementation.

Oil prices soar to $105, will Bitcoin be dragged down?
Summary: Oil prices hit a three-year high, and the market discusses whether BTC will repeat the correlation drop.
Macroeconomic variables are back in the spotlight: inflation expectations, risk appetite, and liquidity are tightening together. Don't rush to find a single narrative; first, pay attention to the changes in leverage and funding rates.

Uranium Finance Hacking Case Faces Criminal Hammer
Summary: Accused of $54 million DeFi attack, facing up to 30 years in prison
On-chain is not a lawless land, this statement is becoming a practical cost. For protocol parties, security is no longer just a 'technical budget', but a matter of life and death.

The 10 'Commandments' of Bitcoin are trending again
Summary: The community has compiled 10 principles for holding coins, with over 50 likes in the post
The noisier the market, the more a set of operational rules that won't be swayed by the noise is needed. Clearly writing down 'when not to act' can save an account better than predicting price fluctuations.

401(k) should also include cryptocurrency assets
Summary: The U.S. Department of Labor plans to allow 401(k) to include cryptocurrency, implementing Trump's executive order
The door to the fund pool is about to open: once retirement fund allocation is institutionalized, buying will no longer rely on emotions. The next key step is: how to write the allowable categories, custody, and risk disclosure.

Cardano launches Midnight: Privacy-friendly sidechain
Hoskinson announces the Midnight sidechain, focusing on privacy protection and compliance options
Privacy is not just a slogan; the real challenge is "usable, verifiable, and compliant."
If the sidechain route is successful, it could enable more institutions to move sensitive data onto the chain, rather than just conceptualizing it.
The next most critical factor: whether developer tools, ecological applications, and cross-chain experiences can be seamless.

The Democratic Party pushes for restrictions on prediction markets: Prevent insider betting
Lawmakers call for warnings to federal officials to avoid conflicts of interest transactions in prediction markets
Prediction markets are moving from "fringe experiments" to "policy issues".
Once included in a stricter conflict of interest framework, the participation threshold will increase, but it may also bring greater mainstream acceptance.
Next to watch: whether the rules are direct restrictions or managed through disclosure and auditing.

Senator questions SEC: Why withdraw charges against Sun Yuchen
After a brief tenure of the former SEC enforcement head, the Sun Yuchen case has raised controversy about the withdrawal of charges.
The signals from regulation sometimes impact market expectations more than the penalties themselves.
The key to this controversy is not just whether to "withdraw or not," but how the outside world interprets consistency and transparency.
In the short term, it looks like emotional fluctuations, but in the long term, it will force the industry to clarify compliance paths more clearly.

Uranium Finance hacking case progresses: Involved $54 million
A Maryland man is accused of stealing approximately $54 million, with a maximum sentence of 30 years
The latter half of the DeFi security incident often takes place not on-chain, but in court.
When law enforcement can bring "anonymity" back to reality, the cost for hackers will structurally increase.
What to watch next: tracking the flow of funds, accomplice charges, and whether more attacking groups will be implicated.

The US 401(k) may open the floodgates to crypto assets
Regulatory rules are set to be adjusted, potentially unlocking trillions of dollars in pension funds
If this rule is indeed implemented, the biggest change won't be the price of cryptocurrencies, but the source of funds.
Once long-term funds like the 401(k) are allowed to allocate to crypto, products, custody, and compliance will have to upgrade together.
The question becomes: who can first establish a standard answer for "investable, manageable, and auditable"?

The American Bitcoin holdings endorsed by Trump have reached 7000 BTC
The holdings have expanded to 7000 BTC, and the accumulation speed indicates a new risk appetite.
When funds no longer take small steps to test the waters, but instead use "holding milestones" to make their presence felt, emotions often shift from defense to offense. 7000 is not the endpoint; it is more like a signal: Some are treating Bitcoin as part of a long-term asset balance sheet. The focus going forward is whether the accumulation pace continues and whether it encourages similar institutions to follow.

Square automatically enables Bitcoin payments for millions of American merchants
BTC payments have changed from an optional feature to a default switch, covering millions of merchant touchpoints.
Once the payment end is set to default, the real challenge is: are users willing to spend, are merchants willing to retain, and can settlement and taxation be smooth? The launch of the feature is just the starting point, and next we will see the differentiation of the two curves: "penetration rate" and "repeat purchase frequency." If the data comes out, the market will reprice the value of the "payment narrative."

The CFTC states it will "listen more to the alliance's opinions", the NFL demands stricter safeguards for the prediction market.
Pressure is rising on sports leagues, as the prediction market transitions from a gray area to a period of regulatory restructuring.
When regulators hand back the responsibility for risk boundaries to industry organizations, it means the rules of the game need to be rewritten. For trading platforms, compliance thresholds may become clearer and higher; for participants, the nature of the products may shift from "whether it can be done" to "how to do it without crossing the line". The next round of differentiation relies on risk control and licensing, not on gimmicks.

Aster perpetual contract DEX changed to 'pledge issuance only', monthly unlock down 97%
Release rhythm significantly changed, new supply plummeted by 97%, inflation expectations reset.
Supply-side reform first affects not the K-line, but expectations: the selling pressure assumption has changed, and the valuation model must be recalculated. Pledge-driven issuance ties incentives and retention more closely, but it may also concentrate liquidity pressure at a few points in time. Next, we need to see if trading volume can keep up; otherwise, 'emission reduction' merely postpones the problem.

Bitmine makes biggest ether purchase in 2026 while other digital asset treasuries pull back
BitMine made the largest purchase of ETH in 2026, with a clear shift in reserves
Treasury strategies are changing: BitMine completed the largest ETH purchase of 2026.
While other 'digital asset treasuries' are pulling back, it chooses to double down, which the market may interpret as a signal.
Next, we will see: will more companies follow and diversify into ETH, or is it just a contrarian bet by one company.

Strive and Tuttle file for ETF to invest in Strategy’s preferred STRC stock and Strive’s SATA
Strive与Tuttle申报ETF，押注Strategy优
新的包装方式出现了：Strive与Tuttle提交ETF申请，标的指向Strategy的优先股STRC等。
这类产品把“加密敞口”变成更传统的持仓入口，风险结构也随之重排。
一旦获批，资金可能不必直接买币，也能参与同一套波动叙事。

The SEC’s latest crypto guidance still leaves too much unsaid
The SEC’s latest c…
这条消息值得盯：市场结构正在发生变化。
它不是一次性噪音，更像是下一阶段叙事的铺垫。
留意后续数据与监管/资金的连锁反应。

Trump-linked American Bitcoin hits 7,000 BTC milestone as shares slide into penny stock territory
American Bitcoin holdings reach 7,000 BTC, but stock prices have fallen into penny stock territory
On the surface, it is a milestone: holdings exceed 7,000 BTC.
On the other hand, the situation is more glaring: stock prices are sliding into the 'penny stock' range, with financing and valuation pressures amplifying simultaneously.
When narrative and price diverge, the market will force companies to provide clearer answers regarding cash flow and risk hedging.

$296 million net outflow from the U.S. Bitcoin ETF in a single week
$296 million outflow ends the global fund's 4-week net inflow.
As the ETF funds turn, the sentiment cools down. What’s more worth watching is: whether the selling is short-term chips or institutions are rebalancing. If the outflow continues, the market will be forced to reprice the 'demand assumption'.