I Ran `npm fund` and Found 47 Packages Keeping My App Alive
I've been seeing the same line at the bottom of every npm install for years: added 47 packages, and 12 packages are looking for funding run `npm fun…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
- игры
AI
News
Tech
agents
ai
api
architecture
automation
backend
beginners
career
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
Slopsquatting: как мы 20 лет учили разработчиков не доверять пакетам, а потом всем скопом доверились LLM
Двадцать лет ИБ-сообщество учило разработчиков не тащить в проект непроверенные зависимости. А потом мы доверили написание кода LLM, которые с удово…
«Ротируйте всё» — это не план. Разбираемся задела ли атака на цепочку поставок ваш GitHub Actions
Знакомый жанр новостей, правда? В популярный пакет или action подсунули вредоносный код, и все бегут проверять свои сборки. Таких историй…
I gave my coding agents a supply-chain tripwire (and a radar)
My coding agents install packages all day. I don't read the names. Do you? Thought not. And that's a problem, because agents are brilliant at a few…
MemTensor: When an AI Memory Plugin Becomes the Credential Collector
MemTensor: When an AI Memory Plugin Becomes the Credential Collector StepSecurity reported that the open-source AI memory framework MemTensor had it…
Чей номер и чей БИК: две офлайн-библиотеки на открытых реестрах Минцифры и ЦБ
Когда в форме нужно проверить ИНН, подсказать банк по БИК или показать оператора по номеру телефона, обычно подключают внешний API. Мне захотелось о…
Auto-allow npm scripts in Claude Code without allowing npm install
Originally published at https://aicoding-guide.com . A confirmation dialog on every npm run lint , npm run test and npm run build is the single bigg…
Build & Release #3: I Deleted Every npm Token I Own
On October 7th I tried to publish @7onic-ui/tokens@0.3.7 and npm told me my own package didn't exist. npm error 404 Not Found - PUT https://regist…
Building Instagram Reels-style video feeds in React Native with reels-kit
An open-source React Native toolkit for vertical video feeds: snap paging, bounded video players, tap and scrub gestures, and pluggable video adapte…
Парсер расписаний после хабратестирования: полвторого, RRULE, systemd и производственный календарь
В прошлой статье я показал cronsense, библиотеку, которая переводит расписание на русском или английском в cron: «по будням в 9:30» → 30 9 * * 1-5 .…
npm trusted publishing finally covers dist-tags, if you ask nicely
Picture the npm maintainer who did the hard work: moved publishing to OIDC, deleted the automation token from the password manager, celebrated with…
Галлюцинация нейросети в коде обычно ломает сборку. С выдуманным пакетом иначе: его имя может занять вредонос
Я взял 139 имён пакетов, которые пять свежих ИИ-моделей выдумывают одинаково, и 22 сентября проверил каждое по живым PyPI и npm. Это реестры, откуда…
[Перевод] 10 браузерных API, заменяющих библиотеки, которые я раньше все время устанавливал
10 браузерных API, заменяющих пакеты NPM и плагины jQuery: dialog, popover, переходы отображения (view transitions), structuredClone, groupBy и Temp…
Infected by git pull and npm run build — Malware planted in a build config through a forged merge commit
I ran git pull , then npm run build . That was all. I didn't open any suspicious file, and I didn't install any new package. Even so, the moment the…
CaptchaKit: A Self-Hosted CAPTCHA Package for React & Next.js + Try It Live
Adding CAPTCHA to a React or Next.js app usually means relying on an external service. It supports: • Text, number, math, and image CAPTCHAs &…
Is that free data grid free for your project? Checks you can run in a terminal
A few weeks ago we found that our own pricing page listed a paid feature under the free tier. Nobody had noticed for a while. It made me wonder how…
I Wanted to Pay My Dependencies. Only One of Three Registries Would Let Me Find Out Who to Pay.
I run a small actor that normalizes package metadata across npm, PyPI and crates.io — version, license, download counts, the usual. Every so often a…
The Shai-Hulud npm worm showed that opening a folder is enough to run code
The Shai-Hulud npm worm showed that opening a folder is enough to run code In August 2026 an attacker took over the GitHub account of a maintainer w…
Good News For Backend And Devops Buddy
I shipped a Goated tool Today: API Performance Profiler. It answers one question backend devs ask every day: how fast is this route, actually? Most…
Имя вашей внутренней библиотеки может занять кто угодно, и сборка возьмёт его версию
Сборка внутренней библиотеки внезапно стала долгой: вместо секунд - минуты, и в журнале появились обращения наружу. Своя, все зависимости тоже свои,…
Caching VAT and FX Rates at Build Time, Not on the Request Path
Two ways to get exchange rates or VAT tables into an application, and both are wrong in a familiar way. Call a rates API on every request or every c…
An AI impersonated me
I, had a recent security issue, that was fixed. So then I made some DEV posts for it, then I also complained about AI saying I'm a "threat actor" an…
JS/TS библиотека для транслитераций между 50 языками (2450 комбинаций)
Обычно под термином транслитерация подразумевают написание русскоязычного текста latinskimi bukvami. Однако это лишь одна сторона транслитерации - р…
Why we moved our Backstage platform from Yarn to pnpm
What Git worktrees, parallel coding agents, and a cache pointing at the wrong directory taught us about the assumptions hiding inside node_modules .…
Он удалил 11 строк кода. Через час перестали собираться Babel, React Native и тысячи проектов по всему миру
История left-pad, самого нелепого апокалипсиса в истории open-source. Заодно про то, почему миф о надёжности открытого кода не выдерживает проверки…
I am just a developer 😭
So here's the thing. I made a package called UI Tools , and some early versions were flagged for a serious security vulnerability involving its term…
Why npm & pnpm audit miss vulnerabilities
You run pnpm audit in CI. It prints No known vulnerabilities found . The build goes green and you move on. Then someone runs npm audit on the same r…
🤖 What happens when your AI agent trusts outdated docs? I built Docgrity to find the gaps.
🚨📢Launching Docgrity 🚀: Documentation integrity for you, your team, and your agent friends. 🤖 ujja ujja ujja Follow Sep 5 🚨📢Launching Docgrity 🚀: Do…
Three things that surprised me shipping a 200-line npm package
I published a small thing last week — video-bitrate-calculator , a zero-dependency library that works out what video bitrate fits under a target fil…
Your OpenSearch aggregation is lying to you: it returns 200 OK
A dashboard panel went blank in production. No error in the logs, no failed request, no alert. The panel just showed "no data", and the query had be…