I couldn't find an npm package to sort filenames into buckets, so I built one
Last week I was building a file-management feature. Users could upload documents, and I needed to sort them into sections. One bucket for NOCs, one fo…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
- игры
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
claude
devchallenge
devops
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
tutorial
typescript
webdev
We Open-Sourced 42 Construction Calculators — Here's Why
I run EstimatorSuite.com — we review construction estimating software for US contractors (HVAC, electrical, plumbing, roofing, landscaping). We just o…
Stop Generating Nonsense Indian Mock Data. I Built a Better Way!
If you build apps for the Indian market, you've probably needed mock demographic data for testing, UI previews, or training ML models. And if you've u…
They Asked for My AI Rules. But I Could Not Just Hand Them Over.
A team lead announces that the team will start using AI-assisted development. Everyone nods. Nobody asks what that actually means on Monday morning. S…
Brute forcing my way to better HTML > DOCX conversion
About 10 years ago I fell in love with Vue.js. The easy-to-learn syntax and reactivity were a joy to work with, and HMR (hot module replacement) added…
I Built the Vue 3 Japanese Postal Code Library That Didn't Exist
Introduction I'm a full-stack engineer working in Tokyo. One day, I needed to build a feature at work that handles Japanese postal codes. "Enter a pos…
gitlawb-zero Heads to 0.4.0 With a Native npm Binary and Tighter Sandbox
gitlawb-zero is winding up a 0.4.0 release, and the commit stream shows a project maturing its distribution and its security boundaries at the same ti…
10 Useless NPM Packages You Didn't Know You Needed
We have all been there. You are staring at your screen late at night, trying to optimize a bundle size, or debugging an enterprise pipeline that has b…
MCP supply chain attacks are coming — here's how to prepare
The npm incident, but for AI agents Remember when malicious npm packages stole crypto wallets? The same thing is coming for MCP servers. An MCP server…
I made revera, a tool that scores NPM packages before you blindly install them
Ever installed an npm package without really knowing what you were pulling into your project? I did too, and it bugged me enough that I built Revera. …
ChatGPT -> Codex CLI: как перенести контекст диалога в локальную сессию
Обсуждение архитектуры или бага часто начинается в ChatGPT, а реализация продолжается локально в Codex CLI. Рассказываю, как я сделал небольшую CLI-ут…
Preserving Context When Moving from ChatGPT to Codex CLI
A lot of useful technical work starts as a conversation. Maybe you are exploring an architecture decision in ChatGPT. Maybe you are debugging an idea …
Did Deno 2.8 Swallow the npm Toolchain? I Ran install, ci, audit, and pack Myself
Same project, same dependencies. And yet, when I asked both tools "how many vulnerabilities do you have?", they answered differently. $ npm audit 2 vu…
JavaScript still can't ship a full-stack module
Imagine if there were a way for us to somehow ship a full-stack package that you could plug into your app. Client code, backend code, webhooks, and da…
CI is the wrong place to first hear about your npm dependencies
Your CI catches the npm vulnerability. Your developer is already three branches away and one standup behind. The package is installed, the lockfile re…
A Rogue Registry in My Own Backyard: Anatomy of a Two-Line Supply Chain Attack
The previous parts of this series were written from a comfortable distance. I read the Trend Micro diagrams about Shai-Hulud, I theorised about Docker…
Nation-State Actors Are Now Targeting Your AI Agent's npm Packages
This article was originally published on LucidShark Blog . On June 17, 2026, Microsoft Threat Intelligence published a report attributing a supply cha…
Protestware: пережитый тренд или устоявшаяся проблема?
В мире открытого кода термин protestware стал новым классом риска в цепочке поставки ПО: мейнтейнеры намеренно вносят изменения, чтобы выразить личную…
Moving from Migrate Mongo to Mongo Migrate Kit (mmk) Without Re Running Old Migrations
If you're using migrate-mongo and considering a switch, the biggest concern usually isn't features. It's this: "Will I have to re-run old migrations o…
From Code to npm: Vue 3 Component Library Publishing Guide
A complete record of publishing moongate-vue from build to npm, including 2FA, WebAuthn, registry switching, and automation scripts. This article cove…
Vibe-coding и зависимости: как не дать Claude и Cursor затащить дырявый пакет
На прошлой неделе я попросил Claude Code добавить рендеринг markdown в проект. Через секунду в зависимостях появился flutter_markdown — нормальный пак…
Мы спросили, багхантеры они или нет, они сказали «Нет»
Всем привет от команды DFIR JetCSIRT! Хотим поделиться с вами одним интересным кейсом, эмоции от которого прекрасно описывает обложка... Заказчик заво…
What is Monorepo ?
Have you ever built a full-stack application (without fullstack framework like NextJS), if yes so you might definitely know that you need to build two…
Five days with eventferry — MySQL, SQL Server, MSK IAM, and a core that didn't move
Five days ago I posted I built a transactional outbox toolkit for Node.js — meet eventferry . The pitch was small and specific: Postgres + Kafka, the …
Stop Fighting React Native File Systems: Meet rn-file-toolkit
If you've built React Native apps for long enough, you've probably fought with file downloads, uploads, and filesystem management. Historically, the c…
One npm Account Publishes 964 Million Downloads Per Week. None Have Provenance.
The npm account ai publishes seven packages. Combined, they install 964 million times per week: Package Weekly downloads Publishers Risk postcss 245,6…
How I Built the Two Missing Payload CMS v3 Plugins — Reviews, JSON-LD & Real Production Bugs
Running 23 European e-commerce shops on Payload CMS v3 taught me that some things simply don't exist yet. So I built them. Background I maintain a mul…
IronWorm Commits as 'claude.' It Steals Your Anthropic and OpenAI Keys.
On June 3, JFrog Security Research published their analysis of IronWorm — a supply chain attack that compromised 37 npm packages through the asteroidd…
Scarab Field Test #021 — pnpm Self-Upgrade No-Manifest Boundary
Target: pnpm/pnpm Issue: pnpm/pnpm#12240 PR: pnpm/pnpm#12301 Public branch: https://github.com/scarab-systems/pnpm/tree/fix/deps-status-no-manifest La…
Microsoft's npm Packages Got Backdoored. Again. And AI Agents Pulled the Trigger.
73 cryptographically signed npm packages from Microsoft were compromised last week with advanced credential-stealing malware that fires the moment a d…