Hardening Your JavaScript Stack Against the Next npm Supply Chain Worm
Shai-Hulud showed the pattern. Here's the concrete playbook for keeping a self-replicating worm out of your dependency tree.
6 min read
JavaScript
Browser APIs, event handling, observers, framework-agnostic patterns.
11 articles·page 1 of 2
Articles
Shai-Hulud Broke npm's Trust Model. Here's the Replacement
A self-replicating worm hit 500+ packages by stealing publish tokens. npm's fix removes the tokens instead of trusting them harder.
6 min readThe Temporal API Is Here. Here's How to Actually Start Using It
JavaScript's Date object finally has a real replacement, and it's usable in production sooner than you'd think.
6 min readCSS Can Finally Replace Your Tooltip and Dropdown Libraries
Anchor positioning and customizable selects both have real browser support now. Here's what to drop, what to keep, and where the gaps still bite.
5 min readMigrating to TypeScript 7 Without Breaking Your Toolchain
The native compiler is 8-12x faster. The programmatic API isn't ready yet, and that's where teams get burned.
5 min readThe Rise of No-Code and Low-Code in Frontend Development
Benefits, challenges, and the role of AI.
3 min readHow to Determine When a Sticky Element is Stuck in JavaScript
A small JavaScript function for the pseudo-class CSS never gave us.
3 min readEnhance Your React App's Scalability with Storybook and Chromatic
Component libraries and visual regression testing.
9 min readSetting Up Next.js with a Component Library Using Monorepos
A component library, Storybook, and Next.js, all in one workspace.
6 min read4 Tips for Properly Using the Return Statement in JavaScript
A few rules that keep return statements from causing quiet bugs.
3 min read