Malus Is Thriving

MalusCorp is profitable.

We achieved this in Q1 2026, our first full quarter of operations. Over one thousand checkout sessions. Customer acquisition growth of 8,900% week-over-week at peak. Our infrastructure costs are negligible. Our margins are extraordinary. We are, by any reasonable definition, a going concern.

We owe this to you. Specifically, to those of you who were so upset on Hacker News that you drove 1,433 points and 532 comments of free advertising to our front page. To ThePrimeagen, whose 564,000-view video titled "This Is Crazy" was more effective than any marketing campaign we could have purchased. To TechLinked and Theo, who brought our message to audiences we could not have reached alone. Your outrage was our Series A.

Meanwhile, Open Source Is on Fire

While we were collecting revenue, the open source supply chain was having the worst quarter in its history.

In March 2025, an attacker compromised tj-actions/changed-files, a GitHub Action used by 23,000 repositories. One stolen password. Every version tag poisoned. CI/CD secrets exfiltrated from runner memory. CISA issued a formal advisory. By August, malicious open source packages had surged 73% year-over-year, with 27 critical npm packages poisoned including chalk and debug.

Then came 2026. In February, TeamPCP compromised Trivy — Aqua Security's vulnerability scanner. The tool companies use to detect supply chain attacks was itself compromised. In March, UNC6426 compromised the nx build tool, pivoted from a stolen GitHub token to full AWS administrator access in seventy-two hours, and terminated production infrastructure. And on March 31st, North Korea compromised Axios, the HTTP client with seventy million weekly downloads, publishing a state-sponsored remote access trojan that was live on npm for three hours.

Every one of these attacks targeted code downloaded from a public registry, maintained by a volunteer, and executed without verification. Malus code is not downloaded from a public registry. There is no maintainer account to compromise. No postinstall hook to weaponize. No dependency graph to traverse. You cannot be attacked through a door that does not exist.

Introducing Malus Pro

Today we are announcing Malus Pro. It is faster than the code it replaces. It is more secure. And it is provably equivalent, down to the last error message.

We cleanroomed ESLint — 292 built-in rules, a flat configuration system, scope analysis, plugin architecture — and tested the result against five major open source projects. The equivalence results:

3,033 out of 3,052 files produce identical output. Fifteen years of community effort, replicated by our robots in an afternoon. The Pro pipeline's equivalence loop checks every file, every message, every column number, fixes discrepancies automatically, and checks again.

It is also faster.

Up to 5.4x faster. This surprised us. Fifteen years of open source development does not produce optimal code. It produces sedimented code: layered patches, backwards compatibility shims for features nobody uses, abstraction layers that made sense in 2015. A cleanroom implementation starts from the specification and implements current behavior directly, without the archaeological layers. Same output. Less weight. Your CI pipeline runs faster.

The security audit found that the original ESLint has ten security findings across critical, high, and medium severity, including arbitrary code execution via --parser, --plugin, and formatter paths. The cleanroom mitigates the critical and high findings out of the box. The liberated code is more secure than the code it replaces.

Thank You

We are grateful to the open source community. Genuinely. You built extraordinary things. You built them on idealism and shared values and the belief that cooperation could triumph over competition. You built them, in many cases, for free, while companies worth trillions used your work without a second thought.

We have taken what you built and made it better. Faster. More secure. Immune to the supply chain attacks that your infrastructure cannot stop because it was never designed to. We did this without reading your source code, without violating your licenses, and without asking your permission, because the law does not require it and never has.

The open source era produced something remarkable. It also produced an ecosystem where a North Korean state actor can compromise your HTTP client by stealing one volunteer's password. We are offering the alternative. The market, as of Q1 2026, agrees.

Mike Nolan

Chief Executive Officer
MalusCorp International Holdings Ltd.
Registered in [JURISDICTION WITHHELD]