Recent posts tagged npm

Who Should Be Allowed to Change Your npm Release Tags? Your CI/CD pipeline may already be able to publish an npm package. But here’s the more important question: > Should every workflow that can publish also be allowed to change latest, next, or ...

TL;DR: @seosiri/developer-ui-kit v1.0.1, MIT, 0 dependencies is a framework-agnostic React component library with a built-in Flexible Licensing Guard for gating PRO/ENT features in SaaS dashboards. Works with Vite, Next.js, Electron, and Atlassian Fo...

Hey everyone 👋 I recently released vue-pdf-exporthttps://www.npmjs.com/package/vue-pdf-export, an open-source Vue 3 + TypeScript library for generating PDFs directly in the browser. I built it after repeatedly needing the same PDF features across d...

Hey devs, As agentic workflows expand from sandboxed chat into production systems and IoT hardware, prompt engineering alone isn't a sufficient safety barrier. If an agent hallucinates a payload or triggers a cascading loop, traditional error-handli...

Understanding exec in FSCSS In FSCSS, exec serves two completely different purposes depending on where you write it: 1. Inside your stylesheet: as a utility / debugging function 2. In JavaScript / HTML: to load and compile the styles Let’s brea...

A busy week across tooling, supply chain security, and governance. Two stories have immediate action items attached. Here's what mattered. GitHub Copilot bets on model choice, not model loyalty GitHub's latest Copilot update, covering the week of ...

The software supply chain landscape changed forever in early-to-mid 2026. What began as a series of isolated credential-theft incidents quickly mutated into a highly coordinated, multi-registry, self-propagating worm campaign. By abusing trusted rel...

I’ve been working on the SEOSiri MCP Suite—an evolving infrastructure layer for developers building with AI agents. Current architecture: ⚙️ 16 MCP Servers 🧠 163 AI Tools 🌐 11 Edge Gateways 🗺️ Interactive MCP Topology 📦 Developer packages & integra...

Part 2 of 2: the npm-to-uv-to-PyPI bridge that closes the installation gap, and the adversarial re-verification discipline that makes the output worth acting on autonomously Co-authored by Rudrendu Paulhttps://github.com/RudrenduPaul and Sourav Nan...

A team lead announces that the team will start using AI-assisted development. Everyone nods. Nobody asks what that actually means on Monday morning. Some times ago I was in that position. A project I was working on needed to start using AI-assisted ...

There are moments when you stop, look at your terminal, and think: “Why does something as simple as managing packages in JavaScript has to be… so dramatic?” If you've been around the Node.js ecosystem for more than 5 minutes, you know exactly what...

Ever had to print 200 warehouse bin labels and realized there's no clean way to do it from a web app? That's what pushed me to build qrlayout-core and qrlayout-ui — two open source npm packages for designing QR label templates and bulk-printing them...

Ever had to print 200 warehouse bin labels and realized there's no clean way to do it from a web app? That's what pushed me to build qrlayout-core and qrlayout-ui — two open source npm packages for designing QR label templates and bulk-printing the...

Supply-chain attacks via npm are up year-over-year — packages like event-stream, the Lazarus group drops, and AI-hallucinated typosquats keep landing in real codebases. I got tired of finding out after the fact, so I built NPM Safety Guard. What i...

Security dominated this week. A worm hit GitHub's own repos, npm is closing attack vectors that have been open for years, and the developer environment itself is now officially part of the attack surface. But there was plenty of forward-looking news ...

Originally published at harshit.cloudhttps://harshit.cloud/blog/lazy-security-part-1-supply-chain on 2026-04-05. A few months ago a friend's CI pipeline tried to install a package none of us had heard of. The build failed. The error wasn't a missi...

The past 60 days have been brutal for supply chain security: • 639 malicious versions across 323 packages in ONE hour AntV wave • A worm with valid SLSA Build Level 3 provenance TanStack • North Korean APTs injecting malware into "AI-assisted coding...

So, stuff happened and npm has been updated to reduce the volume of stuff happening. In a world of SBOMs, SLSA, and supply chain attacks, it's time to get serious about publishing packages. In this case, that means using the new Trusted Publisher fea...