I Ran `npm fund` and Found 47 Packages Keeping My App Alive
I've been seeing the same line at the bottom of every npm install for years: added 47 packages, and 12 packages are looking for funding run `npm fun…
DevOps
⚑ Report a ProblemLatest DevOps news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
cloud
database
devchallenge
devops
docker
javascript
kubernetes
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
«Ротируйте всё» — это не план. Разбираемся задела ли атака на цепочку поставок ваш GitHub Actions
Знакомый жанр новостей, правда? В популярный пакет или action подсунули вредоносный код, и все бегут проверять свои сборки. Таких историй…
MemTensor: When an AI Memory Plugin Becomes the Credential Collector
MemTensor: When an AI Memory Plugin Becomes the Credential Collector StepSecurity reported that the open-source AI memory framework MemTensor had it…
Чей номер и чей БИК: две офлайн-библиотеки на открытых реестрах Минцифры и ЦБ
Когда в форме нужно проверить ИНН, подсказать банк по БИК или показать оператора по номеру телефона, обычно подключают внешний API. Мне захотелось о…
Build & Release #3: I Deleted Every npm Token I Own
On October 7th I tried to publish @7onic-ui/tokens@0.3.7 and npm told me my own package didn't exist. npm error 404 Not Found - PUT https://regist…
Building Instagram Reels-style video feeds in React Native with reels-kit
An open-source React Native toolkit for vertical video feeds: snap paging, bounded video players, tap and scrub gestures, and pluggable video adapte…
npm trusted publishing finally covers dist-tags, if you ask nicely
Picture the npm maintainer who did the hard work: moved publishing to OIDC, deleted the automation token from the password manager, celebrated with…
[Перевод] 10 браузерных API, заменяющих библиотеки, которые я раньше все время устанавливал
10 браузерных API, заменяющих пакеты NPM и плагины jQuery: dialog, popover, переходы отображения (view transitions), structuredClone, groupBy и Temp…
Infected by git pull and npm run build — Malware planted in a build config through a forged merge commit
I ran git pull , then npm run build . That was all. I didn't open any suspicious file, and I didn't install any new package. Even so, the moment the…
Is that free data grid free for your project? Checks you can run in a terminal
A few weeks ago we found that our own pricing page listed a paid feature under the free tier. Nobody had noticed for a while. It made me wonder how…
The Shai-Hulud npm worm showed that opening a folder is enough to run code
The Shai-Hulud npm worm showed that opening a folder is enough to run code In August 2026 an attacker took over the GitHub account of a maintainer w…
Good News For Backend And Devops Buddy
I shipped a Goated tool Today: API Performance Profiler. It answers one question backend devs ask every day: how fast is this route, actually? Most…
Caching VAT and FX Rates at Build Time, Not on the Request Path
Two ways to get exchange rates or VAT tables into an application, and both are wrong in a familiar way. Call a rates API on every request or every c…
Why we moved our Backstage platform from Yarn to pnpm
What Git worktrees, parallel coding agents, and a cache pointing at the wrong directory taught us about the assumptions hiding inside node_modules .…
Why npm & pnpm audit miss vulnerabilities
You run pnpm audit in CI. It prints No known vulnerabilities found . The build goes green and you move on. Then someone runs npm audit on the same r…
I don't like what AIs are saying about my package (@bananacool467/ui-tools)
If you don't want to read the entire thing, my point is: Ai is literally flagging my entire account as malicious Even though MAL-2026-13416 was only…
The npm Worm That Brought Its Own Interpreter
On November 24, 2025, researchers identified a wave of backdoored npm packages that had been downloading a second JavaScript runtime during install.…
pnpm wins in monorepos, npm wins on zero friction
Run du -sh node_modules on two projects: a small one with fifteen dependencies, and a monorepo with four apps sharing internal packages. On the firs…
A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation
Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sur…
npm trust github Fails with 400 Bad Request: The Missing Permission Flag
We published a JavaScript client to npm this week, and wiring up trusted publishing cost three failed attempts and two wasted two-factor approvals b…
7,798 Components. Import One, Ship One.
James Coombs is a design engineer who maintains the icon package a frontend org installs across roughly twenty apps. Its largest icon set alone is 7…
How do I group an array of objects in JavaScript and sum a field?
import { groupBy } from ' groupjs_by ' ; const byStatus = groupBy ( orders , ' status ' ) . sum ( ' revenue ' , ' amount ' ) . count ( ' orders ' )…
When ‘Are We Affected?’ Requires Reconstructing Yesterday’s npm Install
The concrete problem A package is reported compromised. Your security channel immediately fills with one question: did we ship it? Looking at the re…
How we took malware advisories beyond npm
GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built…
I ported `python-semanticversion` to Rust in 72 hours
For Port Mortem 2026 (a 72-hour "resurrect dead code" hackathon, Track D: Python → Rust), I rewrote python-semanticversion — SemVer 2.0 parsing/comp…
Keyv and Cacheable npm Supply Chain Compromise
An active npm supply chain compromise affected widely used packages in the keyv and cacheable ecosystems, along with packages owned by other maintai…
The npm `overrides` Snippet Everyone Copy-Pastes — And What It Actually Does
You've seen this error. npm install fails with ERESOLVE , you search it, find a GitHub issue, copy an overrides snippet into package.json , and the…
npm walls off 2FA-bypass tokens from account and package management
A token that skips 2FA is a bad idea (until you need one at 3am) You automate your npm publishes with a token that skips the 2FA prompt, because rob…
Disrupting supply chain attacks on npm and GitHub Actions
Explore the changes we've shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their i…
Brute forcing my way to better HTML > DOCX conversion
About 10 years ago I fell in love with Vue.js. The easy-to-learn syntax and reactivity were a joy to work with, and HMR (hot module replacement) add…