I gave my coding agents a supply-chain tripwire (and a radar)
My coding agents install packages all day. I don't read the names. Do you? Thought not. And that's a problem, because agents are brilliant at a few…
Testing & QA
⚑ Report a ProblemLatest Testing & QA news from Tech News
All topics
agents
ai
api
architecture
automation
backend
beginners
career
claude
cybersecurity
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
Auto-allow npm scripts in Claude Code without allowing npm install
Originally published at https://aicoding-guide.com . A confirmation dialog on every npm run lint , npm run test and npm run build is the single bigg…
Build & Release #3: I Deleted Every npm Token I Own
On October 7th I tried to publish @7onic-ui/tokens@0.3.7 and npm told me my own package didn't exist. npm error 404 Not Found - PUT https://regist…
Building Instagram Reels-style video feeds in React Native with reels-kit
An open-source React Native toolkit for vertical video feeds: snap paging, bounded video players, tap and scrub gestures, and pluggable video adapte…
Парсер расписаний после хабратестирования: полвторого, RRULE, systemd и производственный календарь
В прошлой статье я показал cronsense, библиотеку, которая переводит расписание на русском или английском в cron: «по будням в 9:30» → 30 9 * * 1-5 .…
Infected by git pull and npm run build — Malware planted in a build config through a forged merge commit
I ran git pull , then npm run build . That was all. I didn't open any suspicious file, and I didn't install any new package. Even so, the moment the…
I Wanted to Pay My Dependencies. Only One of Three Registries Would Let Me Find Out Who to Pay.
I run a small actor that normalizes package metadata across npm, PyPI and crates.io — version, license, download counts, the usual. Every so often a…
Good News For Backend And Devops Buddy
I shipped a Goated tool Today: API Performance Profiler. It answers one question backend devs ask every day: how fast is this route, actually? Most…
JS/TS библиотека для транслитераций между 50 языками (2450 комбинаций)
Обычно под термином транслитерация подразумевают написание русскоязычного текста latinskimi bukvami. Однако это лишь одна сторона транслитерации - р…
Why we moved our Backstage platform from Yarn to pnpm
What Git worktrees, parallel coding agents, and a cache pointing at the wrong directory taught us about the assumptions hiding inside node_modules .…
I Kept Rebuilding PDF Features in Vue 3, So I Built vue3-pdf-export
I Kept Rebuilding PDF Features in Vue 3, So I Built vue3-pdf-export I recently published vue3-pdf-export , an open-source Vue 3 + TypeScript package…
NestJS Recipes
Hello everyone! Hope you are having a great day. 🖐️ There is always that foundational boilerplate code in NestJS projects that takes up most of our…
I don't like what AIs are saying about my package (@bananacool467/ui-tools)
If you don't want to read the entire thing, my point is: Ai is literally flagging my entire account as malicious Even though MAL-2026-13416 was only…
The npm Worm That Brought Its Own Interpreter
On November 24, 2025, researchers identified a wave of backdoored npm packages that had been downloading a second JavaScript runtime during install.…
pnpm wins in monorepos, npm wins on zero friction
Run du -sh node_modules on two projects: a small one with fifteen dependencies, and a monorepo with four apps sharing internal packages. On the firs…
Publishing My First Rust npm Package (@seucra/matrix-sdk-bridge)
Introduction Publishing a package to npm is a common milestone for JavaScript developers. However, publishing an npm package written in Rust and com…
I ported `python-semanticversion` to Rust in 72 hours
For Port Mortem 2026 (a 72-hour "resurrect dead code" hackathon, Track D: Python → Rust), I rewrote python-semanticversion — SemVer 2.0 parsing/comp…
Keyv and Cacheable npm Supply Chain Compromise
An active npm supply chain compromise affected widely used packages in the keyv and cacheable ecosystems, along with packages owned by other maintai…
The npm `overrides` Snippet Everyone Copy-Pastes — And What It Actually Does
You've seen this error. npm install fails with ERESOLVE , you search it, find a GitHub issue, copy an overrides snippet into package.json , and the…
I Published My First npm Package - BurnLink
A few days ago, I released BurnLink on npm with one goal: make it easier for developers to integrate BurnLink into their Node.js applications. As a…
Disrupting supply chain attacks on npm and GitHub Actions
Explore the changes we've shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their i…
How redis-packhash Helps You Leverage Listpack Hashes in Redis
In my earlier post , I showed that storing a million small values as Redis keys is a waste of memory. It's because every key has its own overhead. T…
Как я автоматизировал превращение вайбкодерского PoC в production-ready MVP
Как я автоматизировал превращение вайбкодерского PoC в production-ready MVP За несколько часов с помощью AI можно собрать работающий PoC: интерфейс…
I couldn't find an npm package to sort filenames into buckets, so I built one
Last week I was building a file-management feature. Users could upload documents, and I needed to sort them into sections. One bucket for NOCs, one…
Stop Generating Nonsense Indian Mock Data. I Built a Better Way!
If you build apps for the Indian market, you've probably needed mock demographic data for testing, UI previews, or training ML models. And if you've…
They Asked for My AI Rules. But I Could Not Just Hand Them Over.
A team lead announces that the team will start using AI-assisted development. Everyone nods. Nobody asks what that actually means on Monday morning.…
Brute forcing my way to better HTML > DOCX conversion
About 10 years ago I fell in love with Vue.js. The easy-to-learn syntax and reactivity were a joy to work with, and HMR (hot module replacement) add…
ChatGPT -> Codex CLI: как перенести контекст диалога в локальную сессию
Обсуждение архитектуры или бага часто начинается в ChatGPT, а реализация продолжается локально в Codex CLI. Рассказываю, как я сделал небольшую CLI-…
Did Deno 2.8 Swallow the npm Toolchain? I Ran install, ci, audit, and pack Myself
Same project, same dependencies. And yet, when I asked both tools "how many vulnerabilities do you have?", they answered differently. $ npm audit 2…
Protestware: пережитый тренд или устоявшаяся проблема?
В мире открытого кода термин protestware стал новым классом риска в цепочке поставки ПО: мейнтейнеры намеренно вносят изменения, чтобы выразить личн…