Hardening Your JavaScript Stack Against the Next npm Supply Chain Worm
Shai-Hulud showed the pattern. Here's the concrete playbook for keeping a self-replicating worm out of your dependency tree.
6 min read
Now
What has my attention this month, kept honest by a visible date.
Updated 06 09 2026|Cape Town, GMT+2
Building
Rebuilding this site with self-hosted fonts and no client-side framework on article pages. The brief I gave myself: every page under 50KB of JavaScript, and a real answer for how AI crawlers read it.
Leading
Tech lead on the mobile app for a major U.S. motorcycle brand, built in React Native and Expo. Different muscles than a browser: same discipline about state, worse tooling for finding out why a screen re-rendered.
Traveling
Booked for Lead Dev NYC. Still working out which talks to skip in favour of the hallway track.
Reading
Loop engineering and agentic workflows — where an AI agent's plan–execute–verify loop earns trust, and where it still needs a human in the loop before anything ships.
Not doing
Consulting work, new side projects, and anything that requires a fourth Slack workspace.