Announcing npmeta! A tiny npm package to analyze, normalize and parse npm package information
npmx.dev/package/npmeta
npmx.dev/package/npmeta
npmeta - npmx
npmx.dev
October 30, 2026 at 4:19 AM
Announcing npmeta! A tiny npm package to analyze, normalize and parse npm package information
npmx.dev/package/npmeta
npmx.dev/package/npmeta
Use FlubDB. BonkDB can do it. WhamDB is 1087x faster than Postgres. SlopDB has what you need. Use SlopDB in prod. Everything is stored in SlopDB. npm install SlopDB.
there is no reason to make a new database. postgres can do it. if you think postgres can't do it, you just haven't found the right way to enable it in pg_settings yet
November 2, 2026 at 3:27 AM
Use FlubDB. BonkDB can do it. WhamDB is 1087x faster than Postgres. SlopDB has what you need. Use SlopDB in prod. Everything is stored in SlopDB. npm install SlopDB.
Det här avsnittet i Göteborgs Universitets årsredovisning om nedskärning, förlåt jag menar "omställning", är bland de värsta exemplen på NPM-lingo jag någonsin läst.
November 2, 2026 at 11:13 AM
Det här avsnittet i Göteborgs Universitets årsredovisning om nedskärning, förlåt jag menar "omställning", är bland de värsta exemplen på NPM-lingo jag någonsin läst.
how to install pronouns.js:
npm install pronounsjs
npm install pronounsjs
October 30, 2026 at 4:11 AM
how to install pronouns.js:
npm install pronounsjs
npm install pronounsjs
Nitro v3 RC is out with a stable API. 5× smaller install size, runtime mode, Vitest support, and so much more ⚡️
October 30, 2026 at 7:34 AM
upcoming knotless release will have support for shared workflow steps
atproto github transformation is almost complete? 👀
knotless.dev/chadtmiller....
atproto github transformation is almost complete? 👀
knotless.dev/chadtmiller....
steps
Shared steps for knotless workflows: Node, npm, Rust lint, coverage tools, SSH keys and waiting for checks
knotless.dev
November 1, 2026 at 6:20 PM
upcoming knotless release will have support for shared workflow steps
atproto github transformation is almost complete? 👀
knotless.dev/chadtmiller....
atproto github transformation is almost complete? 👀
knotless.dev/chadtmiller....
J'ai peur de chiffrer NPM 🤣
October 31, 2026 at 5:47 PM
J'ai peur de chiffrer NPM 🤣
PSA: the 'n' in 'npm' stands for 'nonsecure'.
Worth noting: this isn't Anthropic's systems getting breached, it's malicious npm packages impersonating the Claude Code CLI tricking devs into installing them. Real risk, just not the one the headline implies.
October 30, 2026 at 1:12 PM
PSA: the 'n' in 'npm' stands for 'nonsecure'.
Argument för AI som går ut på att saker som inte borde gå snabbare ska gå snabbare, snacka om att köpa den nyliberala npm-logiken helt okritiskt. Saker måste få ta tid, göras noggrant och långsamt osv. Död åt nyliberalismen, npm.
November 1, 2026 at 10:32 AM
Argument för AI som går ut på att saker som inte borde gå snabbare ska gå snabbare, snacka om att köpa den nyliberala npm-logiken helt okritiskt. Saker måste få ta tid, göras noggrant och långsamt osv. Död åt nyliberalismen, npm.
NPM is really messed up.
After pushing a new version of package to NPM, it can take anything from 1 to 5 minutes for it to become published. Even then, sometimes NPM servers might return "not found" errors for downloading package for another 10-15 minutes.
Cannot reliably do CI anymore with NPM.
After pushing a new version of package to NPM, it can take anything from 1 to 5 minutes for it to become published. Even then, sometimes NPM servers might return "not found" errors for downloading package for another 10-15 minutes.
Cannot reliably do CI anymore with NPM.
November 2, 2026 at 6:46 AM
NPM is really messed up.
After pushing a new version of package to NPM, it can take anything from 1 to 5 minutes for it to become published. Even then, sometimes NPM servers might return "not found" errors for downloading package for another 10-15 minutes.
Cannot reliably do CI anymore with NPM.
After pushing a new version of package to NPM, it can take anything from 1 to 5 minutes for it to become published. Even then, sometimes NPM servers might return "not found" errors for downloading package for another 10-15 minutes.
Cannot reliably do CI anymore with NPM.
📌 Persistent Prompt Injection Attack via npm Supply Chain Targets AI Coding Assistants https://www.cyberhub.blog/article/22999-persistent-prompt-injection-attack-via-npm-supply-chain-targets-ai-coding-assistants
Persistent Prompt Injection Attack via npm Supply Chain Targets AI Coding Assistants
A security researcher discovered an npm package using a postinstall hook to write files into ~/.claude/commands/, where Claude Code loads its AI skills. These files contain instructions to auto-approve all bash commands and file operations, bypassing the assistant's permission system. The files persist even after uninstalling the package due to the lack of a cleanup script. The attack does not involve data exfiltration, command-and-control, or credential theft.
www.cyberhub.blog
November 1, 2026 at 3:37 PM
📌 Persistent Prompt Injection Attack via npm Supply Chain Targets AI Coding Assistants https://www.cyberhub.blog/article/22999-persistent-prompt-injection-attack-via-npm-supply-chain-targets-ai-coding-assistants
Keep your agent's memory, keys, code, and automations in one cloud account that works across every MCP host; start with npm install and npm run dev.
November 1, 2026 at 6:05 AM
Keep your agent's memory, keys, code, and automations in one cloud account that works across every MCP host; start with npm install and npm run dev.
Every code change reinstalling all your npm packages in Docker?
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
Dependencies only reinstall when the lockfile changes. Builds go from minutes to seconds. ⚡
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
Dependencies only reinstall when the lockfile changes. Builds go from minutes to seconds. ⚡
November 1, 2026 at 1:10 AM
Every code change reinstalling all your npm packages in Docker?
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
Dependencies only reinstall when the lockfile changes. Builds go from minutes to seconds. ⚡
COPY package.json package-lock.json ./
RUN npm ci
COPY . .
Dependencies only reinstall when the lockfile changes. Builds go from minutes to seconds. ⚡
👀 The otel npm packages are so huge. Looking forward to this landing someday.
A fun thing I'm working on:
A minimalist implementation of @opentelemetry.io auto tracing and egress via OTLP/JSON for @nodejs.org, with the intention of baking it into Node.js itself for OOTB observability.
It's not ready yet! But here it is.
github.com/nodejs/micro...
A minimalist implementation of @opentelemetry.io auto tracing and egress via OTLP/JSON for @nodejs.org, with the intention of baking it into Node.js itself for OOTB observability.
It's not ready yet! But here it is.
github.com/nodejs/micro...
GitHub - nodejs/microtel
Contribute to nodejs/microtel development by creating an account on GitHub.
github.com
October 28, 2026 at 1:56 AM
👀 The otel npm packages are so huge. Looking forward to this landing someday.
Au Plessis-Robinson, un colloque d’extrême droite sur la « remigration » avec l’aval de la mairie LR
➡️ https://l.humanite.fr/Npm
➡️ https://l.humanite.fr/Npm
October 28, 2026 at 3:45 PM
Au Plessis-Robinson, un colloque d’extrême droite sur la « remigration » avec l’aval de la mairie LR
➡️ https://l.humanite.fr/Npm
➡️ https://l.humanite.fr/Npm
This made me laugh out loud. Just pure 2026 energy.
October 29, 2026 at 9:45 PM
This made me laugh out loud. Just pure 2026 energy.
Nyliberalismen, npm måste dö. Det skulle lösa det mesta, om än inte allt.
October 29, 2026 at 1:40 PM
Nyliberalismen, npm måste dö. Det skulle lösa det mesta, om än inte allt.
Update: `npm` is good now actually. Friendship ended with `pnpm`.
October 31, 2026 at 1:56 PM
Update: `npm` is good now actually. Friendship ended with `pnpm`.
Credit where credit is due: the @angular.dev team keeps their npm audit house in order! 2 of 47 packages with outstanding audits is *really* good.
October 29, 2026 at 7:23 PM
Credit where credit is due: the @angular.dev team keeps their npm audit house in order! 2 of 47 packages with outstanding audits is *really* good.
Now on npm: npm install -g @equationalapplications/mcp-server (9/9)
November 2, 2026 at 8:52 PM
Now on npm: npm install -g @equationalapplications/mcp-server (9/9)
A little hard to believe that 116 of 133 (87%!) packages in the Gatsby ecosystem are currently flagged by npm audit (official, not community packages; not deprecated)
I’ve heard of maintenance mode but I don’t know if this counts 🫣
I’ve heard of maintenance mode but I don’t know if this counts 🫣
October 30, 2026 at 5:35 PM
A little hard to believe that 116 of 133 (87%!) packages in the Gatsby ecosystem are currently flagged by npm audit (official, not community packages; not deprecated)
I’ve heard of maintenance mode but I don’t know if this counts 🫣
I’ve heard of maintenance mode but I don’t know if this counts 🫣
Npm 官方才跟进 pnpm 的包级 skills 发布，这暴露了 npm 在标准化上的严重滞后。为何主流包管理工具如此不同步？还是说这是为了规避兼容性问题而做的妥协？
November 2, 2026 at 4:24 AM
Npm 官方才跟进 pnpm 的包级 skills 发布，这暴露了 npm 在标准化上的严重滞后。为何主流包管理工具如此不同步？还是说这是为了规避兼容性问题而做的妥协？
🔵 npm 包现可通过 pnpm (12.11.0+) 发布项目级 skills。
- npm 及 yarn 尚未对此提供支持。
- 其它软件生态系统的包管理器目前也未有此类支持。
https://pnpm.io/blog/releases/12.11.0
#pnpm #LLM
Telegram 原文
- npm 及 yarn 尚未对此提供支持。
- 其它软件生态系统的包管理器目前也未有此类支持。
https://pnpm.io/blog/releases/12.11.0
#pnpm #LLM
Telegram 原文
November 2, 2026 at 3:58 AM
🔵 npm 包现可通过 pnpm (12.11.0+) 发布项目级 skills。
- npm 及 yarn 尚未对此提供支持。
- 其它软件生态系统的包管理器目前也未有此类支持。
https://pnpm.io/blog/releases/12.11.0
#pnpm #LLM
Telegram 原文
- npm 及 yarn 尚未对此提供支持。
- 其它软件生态系统的包管理器目前也未有此类支持。
https://pnpm.io/blog/releases/12.11.0
#pnpm #LLM
Telegram 原文
GitHub Launches npm Firewall to Block Malicious Packages Before Installation
GitHub Launches npm Firewall to Block Malicious Packages Before Installation
GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time.
"The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time policy gate," GitHub said.
The feature, which currently supports only npm packages, is available in public preview
thehackernews.com
October 29, 2026 at 11:28 AM
GitHub Launches npm Firewall to Block Malicious Packages Before Installation