axios Package Compromised; Malicious Versions Added a Trojan Dependency — Axios is an HTTP library that gets 100M+ downloads a week, largely due to its legacy popularity. An attacker took advantage of that to roll out a version with a malicious dependency including a remote access trojan (though Axios' codebase itself was fine). This is big, as even if you don’t use Axios, your dependencies might. Here's how to see if you're affected.

Ashish Kurmi

Still Writing Tests Manually? Meticulous AI Is Here — Notion, Dropbox, Wiz and LaunchDarkly now use a testing paradigm they can’t work without. Built by former Palantir engineers, Meticulous automatically creates an evolving suite of E2E UI tests, delivering exhaustive coverage with no developer effort.

Meticulous sponsor

Transformers.js v4: Run AI Models in the Browser — Brings Hugging Face-hosted transformer models into JavaScript, so you can run NLP, vision, and audio models in-browser. v4 switches to a WebGPU runtime and is installable with npm. There are many live demos covering real-time speech transcription, using Qwen 3.5, and real-time video captioning.

Hugging Face

Signals: The Push-Pull Based Algorithm — A well-diagrammed ground-up explanation of how signals work internally, focusing on the push-pull algorithm at the core of reactivity in frameworks like Solid, Vue, and Angular.

Willy Brauner

🖼️ Your Options for Preloading Images with JavaScript — “There are a number of ways to preload an image on demand with JavaScript, each with their own strengths and drawbacks. Let's explore them.”

Alex MacArthur

A Gentle Intro to npm Workspaces (With Visuals) — Workspaces let you manage multiple packages in one repo and link local packages so they can import each other by name. npm may then hoist and deduplicate compatible dependencies during install.

Carlos Precioso

Pretext: A Multiline Text Measurement and Layout Library — Cheng Lou, formerly a React core team member, caused a stir with this X post three days ago, racking up 22M impressions and getting 25k stars on this repo since. Why? People are very excited about the potential for real time web layouts! There are demos here if you want to see what the excitement is about, although the library itself is reasonably straightforward.

Cheng Lou

GitHub Actions 🤝Expo CI/CD Workflows — Keep GitHub Actions. Add Expo Workflows for mobile: M4 Pro builds, E2E tests, OTA. Let each tool handle what it’s best at.

Expo sponsor

Knip v6: The Tool to Declutter Your JS/TS Projects — Knip is a go-to tool for finding and removing unused files, exports, and dependencies in projects. v6 integrates oxc for 2-4x performance gains (it tears through Astro in two seconds) and is largely a drop-in upgrade.

Lars Kappert

📺 ArtPlayer: A Modern, Full-Featured HTML5 Video Player — A straightforward way to get your own heavily-customizable YouTube-style player experience. There’s a full, live demo/playground showing it off.

Harvey Zhao

Semiotic 3.0: React + D3 Data Visualization Framework — Does the basics well, but has some more unique offerings like choropleth maps, Sankey diagrams, flow maps, and violin plots, plus streaming data support.

nteract