ChainDrop: when malicious npm packages spread themselves
What ChainDrop teaches us about credential theft, self-propagating npm malware, and practical supply-chain defenses.
Security · Security · npm · Supply Chain · ChainDrop
Search posts
36 posts found
COLDCARD's weak randomness flaw and wallet seed security
Why a firmware update cannot repair wallets created with weak COLDCARD seed randomness.
Security · Security · Crypto Wallet · CSPRNG · Seed Phrase
Vite, Rspack, and SSR Streaming in Nuxt 4.5
Separating the roles of Vite, Rspack, and SSR Streaming in Nuxt 4.5.
Nuxt · Nuxt · Vite · Rspack · SSR Streaming
Is React Compiler ready to adopt? Start with the problem it solves
A practical look at manual memoization, developer experience, and the constraints teams should evaluate before adopting React Compiler.
React · React · Compiler · Performance
TypeScript 7 moves to a native compiler
Beyond speed, the compatibility questions to consider when TypeScript 7 adopts its native compiler.
TypeScript · TypeScript · Go · Compiler · Migration
View Transitions API: page transitions without surrendering to a framework
A progressive-enhancement view of View Transitions and the practical trade-offs for content sites and product interfaces.
Web Platform · CSS · Animation · Web API
Astro 7's Rust compiler and MDX changes
What content sites and MDX users should check as Astro 7 moves more compilation work to Rust.
Content Sites · Astro · Rust · MDX · Vite
The important changes from Angular 20 to 22
How Signals, zoneless change detection, SSR, forms, and data fetching evolved across Angular 20 through 22.
Angular · Angular · Signals · Zoneless · Signal Forms · Fetch
Modern CSS is more than syntax sugar: from container queries to native nesting
A review of recent CSS capabilities and the jobs that no longer need JavaScript or a preprocessor.
CSS · CSS · Container Query · Responsive
WebMCP and websites designed for agents
How a website can expose structured actions to an AI agent while preserving authorization and user confirmation.
AI Development Tools · WebMCP · AI Agent · Web API · Security
Scoped View Transitions in Chrome 147
Using scoped View Transitions for lists, cards, and state changes inside a component.
Web Platform · Chrome · View Transitions · CSS · Animation
Moving from TypeScript 6 to native TypeScript 7
Use TypeScript 6 to remove old configuration before moving to the Go-based native TypeScript 7 toolchain.
TypeScript · TypeScript · Migration · Compiler · Tooling
Why Vite 8 switched to Rolldown
Why Vite replaced its build core and which compatibility details matter during the move to Rolldown.
Frontend Tooling · Vite · Rolldown · Rust · Build Tools
Breaking down Matt Pocock's Agent Skills
How an Agent Skill differs from a prompt and how teams can document repeatable engineering workflows.
AI Development Tools · AI · Agent Skills · Developer Workflow · Matt Pocock
The content-site experience in Astro 6 Beta
How Astro 6 Beta approaches fonts, security policy, the dev server, and dynamic content.
Content Sites · Astro · CSP · Fonts · Content Collections
Looking back at Server Components: how much of the promise survived?
A retrospective separating the architectural value of Server Components from framework implementation and team cost.
Retrospective · React · RSC · Architecture
React2Shell and the attack surface of React Server Components
Why React2Shell means frontend teams must understand server vulnerabilities and patching too.
Security · React · React Server Components · Security · RCE
Angular 21: Signals and agent development tools
How Angular 21 updates forms, accessibility, testing, and AI-assisted development at the same time.
Angular · Angular · Signal Forms · Angular Aria · Vitest · MCP
Beyond Core Web Vitals: how I observe real user experience
Metrics are not a scoring game. Reframing frontend performance around user tasks, device differences, and field monitoring.
Performance · Performance · Web Vitals · UX
The end of npm classic tokens and safer package publishing
Why package publishing is moving from long-lived npm tokens toward short-lived credentials.
Security · npm · Security · Trusted Publishing · Supply Chain
How Baseline changes the way we judge browser support
A shared support baseline makes product and engineering discussions more precise than a simple can-we-use-it question.
Web Platform · Baseline · Compatibility · Web API
The React Foundation and React's governance shift
The React Foundation will not change an API overnight, but it may shape React's long-term governance and resources.
React · React · Open Source · Governance
Nuxt UI v4 or a custom design system?
The costs and tradeoffs of Nuxt UI v4, headless components, and maintaining a custom design system.
Nuxt · Nuxt UI · Design System · Vue · UI Components
S1ngularity: the Nx package supply-chain attack
A review of the Nx S1ngularity attack and the protections frontend teams can actually apply.
Security · Security · npm · Supply Chain · Nx
Framework-independent UI components in Tailwind Plus
After Tailwind Plus added Vanilla JavaScript support, do small interactions still need a framework?
CSS · Tailwind CSS · Vanilla JavaScript · UI Components
Nuxt 4: major changes and upgrade notes
Notes on Nuxt 4's app directory, TypeScript project boundaries, data fetching, and a safer upgrade order.
Nuxt · Nuxt · Vue · TypeScript · Migration
Vite 7 browser support and Baseline
A plain-language explanation of Vite 7's Baseline Widely Available browser target.
Frontend Tooling · Vite · Baseline · Browser Support · Build Tools
New CSS and Web APIs in Safari 26
A tour of Safari 26's Anchor Positioning, scroll-driven animations, HDR, credentials, and security APIs.
Web Platform · Safari · WebKit · CSS · Web API
What Angular 20 says about modern Angular development
A practical overview of Signals, incremental hydration, route-level rendering, and zoneless Angular.
Angular · Angular · Signals · Zoneless · SSR · Hydration
Web Platform updates from Chrome at I/O 2025
The browser features from Google I/O 2025 that ordinary frontend projects may actually use soon.
Web Platform · Chrome · Web Platform · CSS · Baseline
How Node.js 24 affects the frontend toolchain
What Node.js 24 changes for Vite, Next.js, testing, CI, and frontend development environments.
Frontend Tooling · Node.js · V8 · npm · Frontend Tooling
Native select styling is finally opening up
A look at customizable native selects, progressive enhancement, and the browser-support tradeoffs.
Web Platform · CSS · HTML · Select · Accessibility
TypeScript's native compiler port
Why the TypeScript team chose Go for a new compiler and what native tooling means for large frontend projects.
TypeScript · TypeScript · Go · Compiler · Developer Experience
The Bybit incident and frontend risk in cold-wallet signing
What the Bybit cold-wallet incident teaches us about signing interfaces, blind signing, and multisig workflows.
Security · Security · Crypto Wallet · Frontend Security · Safe
Choosing a React setup after Create React App
How to choose between Vite, Next.js, and other React options after Create React App's retirement.
React · React · Create React App · Vite · Next.js
Tailwind CSS v4 and its CSS-first configuration
What changed when Tailwind moved theme configuration from JavaScript into CSS.
CSS · Tailwind CSS · CSS · Design Tokens