What happens when users design their own package registry frontend
npmx - Package Browser for the npm Registry
a fast, modern browser for the npm registry. Search, browse, and explore packages with a modern interface.
The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog
How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings
Dependency Cultures - Richard Feldman | SSW 2026
third-party apis: community infrastructure on atproto - Keith's Thoughts
you can just build things from an open set of tools
Dependency cooldowns turn you into a free-rider
Against dependency cooldowns as a response to supply chain attacks
npmx: converging communities
The story of the many people and communities that converged to build npmx together
Download pumping: New npm deception technique for supply chain attacks
Learn how attackers exploit automated bot traffic as part of software supply chain attacks to artificially inflate download counters and mask malicious payloads as legitimate.
ATProto User Intents Demo
This is a demo tool which allows atproto accounts to configure a reuse declaration for their public data. You can read more about this atproo mechanism in the "User Intents for Data Reuse" proposal from March 2025. Any account in the atproto network (including Bluesky accounts) can use this tool via OAuth. The source code for this demo is linked above.
honox - npmx
**HonoX** is a simple and fast meta-framework for creating full-stack websites or Web APIs - (formerly _[Sonik](https://github.com/sonikjs/sonik)_). It stands on the shoulders of giants; built on [Hono](https://hono.dev/), [Vite](https://vitejs.dev/), and
Extensible Software in the age of LLMs | Jeremy Morrell
Solid core + capability-based sandboxes + LLMs = Users with superpowers
The Axios supply chain attack used individually targeted social engineering
The Axios team have published a full postmortem on the supply chain attack which resulted in a malware dependency going out in a release the other day, and it involved …