Amazon S3 Files, Malicious npm Plugins, Trivy Fallout, and Kubernetes’ Gateway Shift

This episode of Ship It Weekly is about the interface layer becoming the story. Brian covers Amazon S3 Files and why it feels more like a managed filesystem layer in front of S3 than “S3 is EFS now,” including how it relates to the old s3fs and FUSE-style approach. He also digs into 36 malicious npm packages posing as Strapi plugins, the uglier follow-on to the Trivy incident he discussed previously, Kubernetes Ingress2Gateway 1.0 and the push toward Gateway API, and Kubernetes Agent Sandbox as a sign that newer AI-style workloads are starting to reshape the platform itself.LinksAmazon S3 Fileshttps://aws.amazon.com/blogs/aws/launching-s3-files-making-s3-buckets-accessible-as-file-systems/Malicious npm packages posing as Strapi pluginshttps://thehackernews.com/2026/04/36-malicious-npm-packages-exploited.htmlTrivy follow-on incident discussionhttps://github.com/aquasecurity/trivy/discussions/10425RoseSecurity on Trivy / typosquatting anglehttps://rosesecurity.dev/2026/03/20/typosquatting-trivy.htmlEarlier episode covering the first Trivy incidenthttps://www.tellerstech.com/ship-it-weekly/aws-bahrain-uae-data-center-issues-amid-iran-strikes-argocd-vs-flux-gitops-failures-github-actions-hackerbot-claw-attacks-trivy-roguepilot-codespaces-prompt-injection-block-ai-remake/Kubernetes Ingress2Gateway 1.0https://kubernetes.io/blog/2026/03/20/ingress2gateway-1-0-release/Kubernetes Agent Sandboxhttps://kubernetes.io/blog/2026/03/20/running-agents-on-kubernetes-with-agent-sandbox/Fortinet FortiClient EMS emergency patchhttps://www.fortiguard.com/psirt/FG-IR-26-099Karpathy posthttps://x.com/karpathy/status/2036487306585268612ProofShothttps://github.com/AmElmo/proofshotMore episodes and show noteshttps://shipitweekly.fmOn Call Briefshttps://oncallbrief.com