Hardening Your JavaScript Stack Against the Next npm Supply Chain Worm
Shai-Hulud showed the pattern. Here's the concrete playbook for keeping a self-replicating worm out of your dependency tree.
6 min read
Writing
CSS text-box-trim Finally Fixes Vertical Text Centering
Two small properties trim the invisible space your font adds above and below text, so buttons, tags, and badges align the way the padding math always promised.
5 min readShai-Hulud Broke npm's Trust Model. Here's the Replacement
A self-replicating worm hit 500+ packages by stealing publish tokens. npm's fix removes the tokens instead of trusting them harder.
6 min readYour MCP Servers Are Burning Your Agent's Context Window
Tool definitions load into context before an agent does anything. Code execution and progressive disclosure are how teams are getting that budget back.
5 min readThe Temporal API Is Here. Here's How to Actually Start Using It
JavaScript's Date object finally has a real replacement, and it's usable in production sooner than you'd think.
6 min readAI Is Forking the Engineering Manager Role Into Two Jobs
Middle management is flattening industry-wide. What survives of engineering management is splitting into two tracks that need almost opposite skills.
7 min readSpec-Driven Development: Why the Spec Is Becoming the New Code Review
Prompts drift. A versioned spec is how teams are catching it before it ships.
7 min readUsing CSS's New if() Function Without Breaking Safari and Firefox
One inline conditional to replace three separate at-rules, once the rest of the web catches up.
5 min readCSS Can Finally Replace Your Tooltip and Dropdown Libraries
Anchor positioning and customizable selects both have real browser support now. Here's what to drop, what to keep, and where the gaps still bite.
5 min readWhy AI Coding Agents Need WIP Limits Too
A framework for deciding how many agents one engineer can actually run at once.
6 min read