Posts

Blog

Thoughts on development, engineering, and product.

Newsletter

Get new articles by email. No spam; unsubscribe anytime.

All posts

2 posts
  • 5 min read

    Next.js ships an out-of-band security patch: what to check today

    Three vulnerabilities in Next.js dependencies, two critical and one high, are part of the October 14 fix. Here's the timeline of recent patches, the Next.js 15 deadline, and a safe upgrade checklist.

    nextjssecuritydevops
  • 8 min read

    Two attacks in four days, a package with 15,000 weekly downloads, and npm v12 arriving to try to stop the bleeding

    Injective SDK and Jscrambler were compromised in July 2026, fitting the same pattern that already hit Axios, Red Hat, and node-ipc this year. npm v12, expected this month, promises to end automatic install scripts — but experts say that doesn't fix the real problem.

    cybersecuritynpmsupply-chainjavascriptdevopsopen-source