pnpm wins in monorepos, npm wins on zero friction
Run du -sh node_modules on two projects: a small one with fifteen dependencies, and a monorepo with four apps sharing internal packages. On the firs…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Security Notice: @bananacool467/ui-tools — Use 0.1.9-beta or Newer
Published : August 27, 2026 Package : @bananacool467/ui-tools I want to clarify a security issue affecting earlier versions of @bananacool467/ui-too…
MyAnimeList-Module (NPM)
MyAnimeList Module This module is neither affiliated with nor endorsed by MyAnimeList. All data returned by this module is provided by MyAnimeList.…
api-diff v0.2.0 — 158 downloads in 3 days, now with array validation and onDrift callback
v0.2.0 of @nakshatra6350 /api-diff is live 🚀 158+ downloads in 3 days since launch. Two new features shipped today: → Array item validation with exa…
A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation
Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sur…
npm trust github Fails with 400 Bad Request: The Missing Permission Flag
We published a JavaScript client to npm this week, and wiring up trusted publishing cost three failed attempts and two wasted two-factor approvals b…
7,798 Components. Import One, Ship One.
James Coombs is a design engineer who maintains the icon package a frontend org installs across roughly twenty apps. Its largest icon set alone is 7…
How do I group an array of objects in JavaScript and sum a field?
import { groupBy } from ' groupjs_by ' ; const byStatus = groupBy ( orders , ' status ' ) . sum ( ' revenue ' , ' amount ' ) . count ( ' orders ' )…
DS Express Errors (centralizing errors library) — v1.9.1 Release Notes August 13, 2026
v1.9.1 – August 13, 2026 Fixed missing types (config.d.ts) for errorClasses (Prisma) Added missing types (presets.d.ts, index.d.ts) for GatewayTimeo…
Publishing My First Rust npm Package (@seucra/matrix-sdk-bridge)
Introduction Publishing a package to npm is a common milestone for JavaScript developers. However, publishing an npm package written in Rust and com…
When ‘Are We Affected?’ Requires Reconstructing Yesterday’s npm Install
The concrete problem A package is reported compromised. Your security channel immediately fills with one question: did we ship it? Looking at the re…
How we took malware advisories beyond npm
GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built…
I ported `python-semanticversion` to Rust in 72 hours
For Port Mortem 2026 (a 72-hour "resurrect dead code" hackathon, Track D: Python → Rust), I rewrote python-semanticversion — SemVer 2.0 parsing/comp…
Keyv and Cacheable npm Supply Chain Compromise
An active npm supply chain compromise affected widely used packages in the keyv and cacheable ecosystems, along with packages owned by other maintai…
I made a web framework
Hi everyone! I made an SSR web framework on NPM named Authtics Host (or HostJS ) About Based on tests, it starts the server in under 1 second. For a…
The npm `overrides` Snippet Everyone Copy-Pastes — And What It Actually Does
You've seen this error. npm install fails with ERESOLVE , you search it, find a GitHub issue, copy an overrides snippet into package.json , and the…
I Published My First npm Package - BurnLink
A few days ago, I released BurnLink on npm with one goal: make it easier for developers to integrate BurnLink into their Node.js applications. As a…
npm walls off 2FA-bypass tokens from account and package management
A token that skips 2FA is a bad idea (until you need one at 3am) You automate your npm publishes with a token that skips the 2FA prompt, because rob…
Protect your application from npm supply chain attacks with tinyNpm!
tinyNpm is a vs code extension that helps protect you from supply chain attacks, stale packages, and bloated code! I had been using package.json ver…
I Added an MCP Server to NPMScan for AI Coding Agents
I Added an MCP Server to NPMScan for AI Coding Agents AI coding agents are increasingly choosing libraries, installing dependencies, and modifying p…
Disrupting supply chain attacks on npm and GitHub Actions
Explore the changes we've shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their i…
How redis-packhash Helps You Leverage Listpack Hashes in Redis
In my earlier post , I showed that storing a million small values as Redis keys is a waste of memory. It's because every key has its own overhead. T…
The technical debt of others
On two previous occasions I have written on the risks posed by the inclusion of third party packages, irrespective of the technology stack, and some…
Simplifying Authorization in NestJS: A New Approach
The Problem If you’ve built a decent-sized NestJS application, you know the authorization dance. You start with basic Roles, then suddenly you need…
I couldn't find an npm package to sort filenames into buckets, so I built one
Last week I was building a file-management feature. Users could upload documents, and I needed to sort them into sections. One bucket for NOCs, one…
We Open-Sourced 42 Construction Calculators — Here's Why
I run EstimatorSuite.com — we review construction estimating software for US contractors (HVAC, electrical, plumbing, roofing, landscaping). We just…
Stop Generating Nonsense Indian Mock Data. I Built a Better Way!
If you build apps for the Indian market, you've probably needed mock demographic data for testing, UI previews, or training ML models. And if you've…
They Asked for My AI Rules. But I Could Not Just Hand Them Over.
A team lead announces that the team will start using AI-assisted development. Everyone nods. Nobody asks what that actually means on Monday morning.…
Brute forcing my way to better HTML > DOCX conversion
About 10 years ago I fell in love with Vue.js. The easy-to-learn syntax and reactivity were a joy to work with, and HMR (hot module replacement) add…
I Built the Vue 3 Japanese Postal Code Library That Didn't Exist
Introduction I'm a full-stack engineer working in Tokyo. One day, I needed to build a feature at work that handles Japanese postal codes. "Enter a p…