I Ran `npm fund` and Found 47 Packages Keeping My App Alive
I've been seeing the same line at the bottom of every npm install for years: added 47 packages, and 12 packages are looking for funding run `npm fun…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
I gave my coding agents a supply-chain tripwire (and a radar)
My coding agents install packages all day. I don't read the names. Do you? Thought not. And that's a problem, because agents are brilliant at a few…
MemTensor: When an AI Memory Plugin Becomes the Credential Collector
MemTensor: When an AI Memory Plugin Becomes the Credential Collector StepSecurity reported that the open-source AI memory framework MemTensor had it…
Auto-allow npm scripts in Claude Code without allowing npm install
Originally published at https://aicoding-guide.com . A confirmation dialog on every npm run lint , npm run test and npm run build is the single bigg…
Build & Release #3: I Deleted Every npm Token I Own
On October 7th I tried to publish @7onic-ui/tokens@0.3.7 and npm told me my own package didn't exist. npm error 404 Not Found - PUT https://regist…
Building Instagram Reels-style video feeds in React Native with reels-kit
An open-source React Native toolkit for vertical video feeds: snap paging, bounded video players, tap and scrub gestures, and pluggable video adapte…
npm trusted publishing finally covers dist-tags, if you ask nicely
Picture the npm maintainer who did the hard work: moved publishing to OIDC, deleted the automation token from the password manager, celebrated with…
Infected by git pull and npm run build — Malware planted in a build config through a forged merge commit
I ran git pull , then npm run build . That was all. I didn't open any suspicious file, and I didn't install any new package. Even so, the moment the…
CaptchaKit: A Self-Hosted CAPTCHA Package for React & Next.js + Try It Live
Adding CAPTCHA to a React or Next.js app usually means relying on an external service. It supports: • Text, number, math, and image CAPTCHAs &…
Is that free data grid free for your project? Checks you can run in a terminal
A few weeks ago we found that our own pricing page listed a paid feature under the free tier. Nobody had noticed for a while. It made me wonder how…
I Wanted to Pay My Dependencies. Only One of Three Registries Would Let Me Find Out Who to Pay.
I run a small actor that normalizes package metadata across npm, PyPI and crates.io — version, license, download counts, the usual. Every so often a…
The Shai-Hulud npm worm showed that opening a folder is enough to run code
The Shai-Hulud npm worm showed that opening a folder is enough to run code In August 2026 an attacker took over the GitHub account of a maintainer w…
Good News For Backend And Devops Buddy
I shipped a Goated tool Today: API Performance Profiler. It answers one question backend devs ask every day: how fast is this route, actually? Most…
Caching VAT and FX Rates at Build Time, Not on the Request Path
Two ways to get exchange rates or VAT tables into an application, and both are wrong in a familiar way. Call a rates API on every request or every c…
An AI impersonated me
I, had a recent security issue, that was fixed. So then I made some DEV posts for it, then I also complained about AI saying I'm a "threat actor" an…
Why we moved our Backstage platform from Yarn to pnpm
What Git worktrees, parallel coding agents, and a cache pointing at the wrong directory taught us about the assumptions hiding inside node_modules .…
I am just a developer 😭
So here's the thing. I made a package called UI Tools , and some early versions were flagged for a serious security vulnerability involving its term…
Why npm & pnpm audit miss vulnerabilities
You run pnpm audit in CI. It prints No known vulnerabilities found . The build goes green and you move on. Then someone runs npm audit on the same r…
🤖 What happens when your AI agent trusts outdated docs? I built Docgrity to find the gaps.
🚨📢Launching Docgrity 🚀: Documentation integrity for you, your team, and your agent friends. 🤖 ujja ujja ujja Follow Sep 5 🚨📢Launching Docgrity 🚀: Do…
Three things that surprised me shipping a 200-line npm package
I published a small thing last week — video-bitrate-calculator , a zero-dependency library that works out what video bitrate fits under a target fil…
Your OpenSearch aggregation is lying to you: it returns 200 OK
A dashboard panel went blank in production. No error in the logs, no failed request, no alert. The panel just showed "no data", and the query had be…
I Kept Rebuilding PDF Features in Vue 3, So I Built vue3-pdf-export
I Kept Rebuilding PDF Features in Vue 3, So I Built vue3-pdf-export I recently published vue3-pdf-export , an open-source Vue 3 + TypeScript package…
NestJS Recipes
Hello everyone! Hope you are having a great day. 🖐️ There is always that foundational boilerplate code in NestJS projects that takes up most of our…
I don't like what AIs are saying about my package (@bananacool467/ui-tools)
If you don't want to read the entire thing, my point is: Ai is literally flagging my entire account as malicious Even though MAL-2026-13416 was only…
The npm Worm That Brought Its Own Interpreter
On November 24, 2025, researchers identified a wave of backdoored npm packages that had been downloading a second JavaScript runtime during install.…
pnpm wins in monorepos, npm wins on zero friction
Run du -sh node_modules on two projects: a small one with fifteen dependencies, and a monorepo with four apps sharing internal packages. On the firs…
Security Notice: @bananacool467/ui-tools — Use 0.1.9-beta or Newer
Published : August 27, 2026 Package : @bananacool467/ui-tools I want to clarify a security issue affecting earlier versions of @bananacool467/ui-too…
MyAnimeList-Module (NPM)
MyAnimeList Module This module is neither affiliated with nor endorsed by MyAnimeList. All data returned by this module is provided by MyAnimeList.…
api-diff v0.2.0 — 158 downloads in 3 days, now with array validation and onDrift callback
v0.2.0 of @nakshatra6350 /api-diff is live 🚀 158+ downloads in 3 days since launch. Two new features shipped today: → Array item validation with exa…
A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation
Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sur…