I Ran `npm fund` and Found 47 Packages Keeping My App Alive
I've been seeing the same line at the bottom of every npm install for years: added 47 packages, and 12 packages are looking for funding run `npm fun…
Open Source
⚑ Report a ProblemLatest Open Source news from Tech News
All topics
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
«Ротируйте всё» — это не план. Разбираемся задела ли атака на цепочку поставок ваш GitHub Actions
Знакомый жанр новостей, правда? В популярный пакет или action подсунули вредоносный код, и все бегут проверять свои сборки. Таких историй…
I gave my coding agents a supply-chain tripwire (and a radar)
My coding agents install packages all day. I don't read the names. Do you? Thought not. And that's a problem, because agents are brilliant at a few…
MemTensor: When an AI Memory Plugin Becomes the Credential Collector
MemTensor: When an AI Memory Plugin Becomes the Credential Collector StepSecurity reported that the open-source AI memory framework MemTensor had it…
Чей номер и чей БИК: две офлайн-библиотеки на открытых реестрах Минцифры и ЦБ
Когда в форме нужно проверить ИНН, подсказать банк по БИК или показать оператора по номеру телефона, обычно подключают внешний API. Мне захотелось о…
Auto-allow npm scripts in Claude Code without allowing npm install
Originally published at https://aicoding-guide.com . A confirmation dialog on every npm run lint , npm run test and npm run build is the single bigg…
Build & Release #3: I Deleted Every npm Token I Own
On October 7th I tried to publish @7onic-ui/tokens@0.3.7 and npm told me my own package didn't exist. npm error 404 Not Found - PUT https://regist…
Building Instagram Reels-style video feeds in React Native with reels-kit
An open-source React Native toolkit for vertical video feeds: snap paging, bounded video players, tap and scrub gestures, and pluggable video adapte…
Парсер расписаний после хабратестирования: полвторого, RRULE, systemd и производственный календарь
В прошлой статье я показал cronsense, библиотеку, которая переводит расписание на русском или английском в cron: «по будням в 9:30» → 30 9 * * 1-5 .…
npm trusted publishing finally covers dist-tags, if you ask nicely
Picture the npm maintainer who did the hard work: moved publishing to OIDC, deleted the automation token from the password manager, celebrated with…
Infected by git pull and npm run build — Malware planted in a build config through a forged merge commit
I ran git pull , then npm run build . That was all. I didn't open any suspicious file, and I didn't install any new package. Even so, the moment the…
CaptchaKit: A Self-Hosted CAPTCHA Package for React & Next.js + Try It Live
Adding CAPTCHA to a React or Next.js app usually means relying on an external service. It supports: • Text, number, math, and image CAPTCHAs &…
Is that free data grid free for your project? Checks you can run in a terminal
A few weeks ago we found that our own pricing page listed a paid feature under the free tier. Nobody had noticed for a while. It made me wonder how…
I Wanted to Pay My Dependencies. Only One of Three Registries Would Let Me Find Out Who to Pay.
I run a small actor that normalizes package metadata across npm, PyPI and crates.io — version, license, download counts, the usual. Every so often a…
The Shai-Hulud npm worm showed that opening a folder is enough to run code
The Shai-Hulud npm worm showed that opening a folder is enough to run code In August 2026 an attacker took over the GitHub account of a maintainer w…
Good News For Backend And Devops Buddy
I shipped a Goated tool Today: API Performance Profiler. It answers one question backend devs ask every day: how fast is this route, actually? Most…
Caching VAT and FX Rates at Build Time, Not on the Request Path
Two ways to get exchange rates or VAT tables into an application, and both are wrong in a familiar way. Call a rates API on every request or every c…
An AI impersonated me
I, had a recent security issue, that was fixed. So then I made some DEV posts for it, then I also complained about AI saying I'm a "threat actor" an…
Why we moved our Backstage platform from Yarn to pnpm
What Git worktrees, parallel coding agents, and a cache pointing at the wrong directory taught us about the assumptions hiding inside node_modules .…
Он удалил 11 строк кода. Через час перестали собираться Babel, React Native и тысячи проектов по всему миру
История left-pad, самого нелепого апокалипсиса в истории open-source. Заодно про то, почему миф о надёжности открытого кода не выдерживает проверки…
I am just a developer 😭
So here's the thing. I made a package called UI Tools , and some early versions were flagged for a serious security vulnerability involving its term…
Why npm & pnpm audit miss vulnerabilities
You run pnpm audit in CI. It prints No known vulnerabilities found . The build goes green and you move on. Then someone runs npm audit on the same r…
🤖 What happens when your AI agent trusts outdated docs? I built Docgrity to find the gaps.
🚨📢Launching Docgrity 🚀: Documentation integrity for you, your team, and your agent friends. 🤖 ujja ujja ujja Follow Sep 5 🚨📢Launching Docgrity 🚀: Do…
Three things that surprised me shipping a 200-line npm package
I published a small thing last week — video-bitrate-calculator , a zero-dependency library that works out what video bitrate fits under a target fil…
Your OpenSearch aggregation is lying to you: it returns 200 OK
A dashboard panel went blank in production. No error in the logs, no failed request, no alert. The panel just showed "no data", and the query had be…
I Kept Rebuilding PDF Features in Vue 3, So I Built vue3-pdf-export
I Kept Rebuilding PDF Features in Vue 3, So I Built vue3-pdf-export I recently published vue3-pdf-export , an open-source Vue 3 + TypeScript package…
NestJS Recipes
Hello everyone! Hope you are having a great day. 🖐️ There is always that foundational boilerplate code in NestJS projects that takes up most of our…
I don't like what AIs are saying about my package (@bananacool467/ui-tools)
If you don't want to read the entire thing, my point is: Ai is literally flagging my entire account as malicious Even though MAL-2026-13416 was only…
The npm Worm That Brought Its Own Interpreter
On November 24, 2025, researchers identified a wave of backdoored npm packages that had been downloading a second JavaScript runtime during install.…
pnpm wins in monorepos, npm wins on zero friction
Run du -sh node_modules on two projects: a small one with fifteen dependencies, and a monorepo with four apps sharing internal packages. On the firs…