A new, major npm supply chain attack via Axios

дата:
Plus running AI models in-browser with Transformers.js v4, signals explained, and using Knip v6 to rapidly clean up your codebase.

#​779 — March 31, 2026

Read on the Web
Together with  Meticulous

JavaScript Weekly

axios Package Compromised; Malicious Versions Added a Trojan Dependency — Axios is an HTTP library that gets 100M+ downloads a week, largely due to its legacy popularity. An attacker took advantage of that to roll out a version with a malicious dependency including a remote access trojan (though Axios' codebase itself was fine). This is big, as even if you don't use Axios, your dependencies might. Here's how to see if you're affected.

Ashish Kurmi

💡 More: Socket offers a more accessible breakdown. There's also a GitHub issue discussing the matter. It's worth considering pinning your dependencies, preventing post-install scripts from running (can be configured with npm but is the default in pnpm and Bun) and/or using cooldowns for dependency updates (using minimumReleaseAge in npm or pnpm's approach).

Still Writing Tests Manually? Meticulous AI Is Here — Notion, Dropbox, Wiz and LaunchDarkly now use a testing paradigm they can't work without. Built by former Palantir engineers, Meticulous automatically creates an evolving suite of E2E UI tests, delivering exhaustive coverage with no developer effort.

Meticulous sponsor

Transformers.js v4: Run AI Models in the Browser — Brings Hugging Face-hosted transformer models into JavaScript, so you can run NLP, vision, and audio models in-browser. v4 switches to a WebGPU runtime and is installable with npm. There are many live demos covering real-time speech transcription, using Qwen 3.5, and real-time video captioning.

Hugging Face

RELEASES:

📖  Articles and Videos

Signals: The Push-Pull Based Algorithm — A well-diagrammed ground-up explanation of how signals work internally, focusing on the push-pull algorithm at the core of reactivity in frameworks like Solid, Vue, and Angular.

Willy Brauner

🖼️ Your Options for Preloading Images with JavaScript — "There are a number of ways to preload an image on demand with JavaScript, each with their own strengths and drawbacks. Let's explore them."

Alex MacArthur

▶  Stop Guessing Where Your Next.js App Broke — 7 videos on error monitoring, replays, tracing, and alerts to debug across your Next.js stack. Watch now.

Sentry sponsor

A Gentle Intro to npm Workspaces (With Visuals) — Workspaces let you manage multiple packages in one repo and link local packages so they can import each other by name. npm may then hoist and deduplicate compatible dependencies during install.

Carlos Precioso

📄 'I Decompiled the White House's New App' – Among the surprises in the React Native app are a cookie/paywall bypass injector and dynamic loading of JavaScript from a random user's GitHub Pages... Thereallo

📄 Building a Scroll-Reactive 3D Gallery with Three.js, Velocity, and Mood-Based Backgrounds Houmahani Kane

📄 Why We Replaced Node.js with Bun for 5x Throughput Nick at Trigger

🛠 Code & Tools

Pretext: A Multiline Text Measurement and Layout Library — Cheng Lou, formerly a React core team member, caused a stir with this X post three days ago, racking up 22M impressions and getting 25k stars on this repo since. Why? People are very excited about the potential for real time web layouts! There are demos here if you want to see what the excitement is about, although the library itself is reasonably straightforward.

Cheng Lou

GitHub Actions 🤝Expo CI/CD Workflows — Keep GitHub Actions. Add Expo Workflows for mobile: M4 Pro builds, E2E tests, OTA. Let each tool handle what it's best at.

Expo sponsor

Knip v6: The Tool to Declutter Your JS/TS Projects — Knip is a go-to tool for finding and removing unused files, exports, and dependencies in projects. v6 integrates oxc for 2-4x performance gains (it tears through Astro in two seconds) and is largely a drop-in upgrade.

Lars Kappert

📺 ArtPlayer: A Modern, Full-Featured HTML5 Video Player — A straightforward way to get your own heavily-customizable YouTube-style player experience. There's a full, live demo/playground showing it off.

Harvey Zhao

Semiotic 3.0: React + D3 Data Visualization Framework — Does the basics well, but has some more unique offerings like choropleth maps, Sankey diagrams, flow maps, and violin plots, plus streaming data support.

nteract

  • Heat.js 5.1 (above) – Generate heat maps, charts, and statistics to visualize date-based activity. Now with point/line chart support.

  • numpy-ts 1.2 – NumPy implementation for TypeScript and JavaScript. Now at ~50% native performance and with Float16 support. (Homepage)

  • ts-blank-space 0.8 – Pure JavaScript type-stripper using the TypeScript 6 parser.

  • RxDB 17.0 – Reactive NoSQL database for JS apps with local-first capabilities.

  • filesize.js 11.0.15 – Converts byte counts into human-readable file size strings.

  • 💳 React Stripe.js 6.0 – Components for Stripe.js and Stripe Elements.

  • css-select 7.0 – CSS selector compiler and engine. Now ESM.

  • ESLint Markdown Plugin 8.0 – Lint Markdown with ESLint.

📰 Classifieds

⚡Nimbalyst: Visual workspace for building with Claude Code & Codex. Manage sessions & tasks. Visually edit markdown, mockups, diagrams, code.

Gauntlet AI Live Night School - Stop Shipping Slop: How to Verify AI Generated Code for Production Deployments (Virtual - 4/1)

📢  Elsewhere in the ecosystem

n

Комментарии

Отправить комментарий