# npm npm is the package manager for the Node JavaScript platform, used to publish, discover, install, and develop Node programs. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## htmx 4.0: a Fetch-Based Rewrite, Built-In Morphing Swaps, and Explicit Attribute Inheritance DevFeed: [htmx 4.0: a Fetch-Based Rewrite, Built-In Morphing Swaps, and Explicit Attribute Inheritance]() Original publisher: [Read original article]() Author: Daniel Curtis Published: 2026-09-18T09:32:00Z Content type: news Language: en Sources: [InfoQ]() Topics: [htmx](), [fetch](), [Library](), [Document Object Model (DOM)](), [Streaming](), [API](), [Inheritance](), [JavaScript](), [Ajax](), [CSS](), [npm](), [WebSocket]() Tags: [ajax](), [api](), [css](), [development](), [elements](), [fetch](), [html](), [html5](), [htmx](), [htmx-4-released](), [inheritance](), [javascript](), [library](), [news](), [node-js](), [npm](), [open-source](), [server-side-rendering](), [streaming](), [web-development]() ### AI overview htmx 4.0 has been released as a major rewrite built on the fetch() API. It adds native streaming, built-in morphing swaps that preserve DOM state, multi-target updates, explicit attribute inheritance, standardized event names, and history refetching. The release is distributed under npm's next tag, while htmx 2.x remains supported. ### Source excerpt htmx 4 has been released, featuring a transition from XMLHttpRequest to the fetch() API, enhancing streaming capabilities. Key updates include built-in morphing swaps for DOM state preservation and an hx-partial tag for cleaner updates. Attribute inheritance is now explicit, with event names standardized. The library maintains focus on minimal JavaScript while remaining popular among frameworks. By Daniel Curtis ## PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting DevFeed: [PhantomRaven: An LLM-Generated Information Stealer Developed for Bug Bounty Hunting]() Original publisher: [Read original article]() Author: Maddie Stewart Published: 2026-09-16T13:36:43.658349Z Content type: news Language: en Sources: [Blog]() Topics: [Malware](), [Large Language Model](), [JavaScript](), [npm](), [npm packages](), [Bug Bounty]() Tags: [bug-bounty](), [javascript](), [llm](), [malware](), [npm](), [npm-packages](), [threat-hunting-intel]() ### AI overview CrowdStrike reports that a financially motivated bug bounty hunter developed and distributed PhantomRaven, a JavaScript-based information stealer through npm. The company assesses with high confidence that a large language model was used to write the malware and says the operator likely used it to identify bug bounty opportunities. ### Source excerpt CrowdStrike identified a financially motivated threat actor who works as a bug bounty hunter and who developed and distributed the JavaScript-based information stealer PhantomRaven. ## Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain DevFeed: [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain]() Original publisher: [Read original article]() Author: Yaron Avital Published: 2026-08-21T23:00:21Z Content type: article Language: en Sources: [Unit 42]() Topics: [sdlc](), [Security](), [Application Security](), [CI/CD](), [GitHub Actions](), [npm](), [Bun](), [Python](), [Claude Code](), [vs-code](), [Claude](), [Ethereum]() Tags: [blockchain](), [c2](), [chaindrop](), [ci-cd](), [claude-code](), [general](), [github-actions](), [insights](), [malware](), [npm-packages](), [persistence](), [python](), [sdlc](), [security](), [software-supply-chain-attack](), [supply-chain](), [vs-code]() ### AI overview Unit 42 describes how software supply-chain attackers are targeting developer tools, CI/CD pipelines, accounts, packages, setup scripts and developer environments before software reaches production. It examines the ChainDrop npm worm, which used malicious preinstall hooks, a Bun runtime, an obfuscated payload, Python-based memory theft, stolen tokens and secrets, self-propagation, persistence in VS Code and Claude Code, and Ethereum-managed command-and-control infrastructure. ### Source excerpt Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42. ## The Appwrite CLI is now written in Go DevFeed: [The Appwrite CLI is now written in Go]() Original publisher: [Read original article]() Author: Chirag Aggarwal Published: 2026-08-11T00:00:00Z Content type: article Language: en Sources: [Appwrite Blog]() Topics: [Appwrite](), [Command-line interface](), [Go Language](), [npm](), [TypeScript](), [JSON]() Tags: [announcements](), [cli](), [dependencies](), [go](), [json](), [npm](), [packages](), [typescript]() ### AI overview Appwrite rewrote its CLI from TypeScript and Node to Go while preserving the command surface, flags, exit codes, and JSON output. Measurements reported in the article show lower startup time, installation size, memory use during push, and binary size. ### Source excerpt The Appwrite CLI moves from TypeScript to Go. It starts 17 times faster and installs two packages in place of 330. Every flag, exit code, and byte of JSON output stays the same. ## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough]() Original publisher: [Read original article]() Author: Harness Team Published: 2026-08-10T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ChainDrop](), [npm](), [supply-chain-security](), [Malware](), [npm packages](), [GitHub Actions](), [GitHub]() Tags: [chaindrop](), [ci](), [ci-cd](), [github](), [github-actions](), [integrity](), [least-privilege](), [malware](), [npm](), [npm-worm](), [openid-connect](), [provenance](), [security](), [slsa](), [software-supply-chain-security](), [worm]() ### AI overview The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence. ### Source excerpt ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog ## ChainDrop: Inside a Self-Propagating npm Worm DevFeed: [ChainDrop: Inside a Self-Propagating npm Worm]() Original publisher: [Read original article]() Author: Unit 42 Published: 2026-08-06T22:26:39Z Content type: article Language: en Sources: [Unit 42]() Topics: [ChainDrop](), [npm](), [Malware](), [C2](), [Ethereum](), [GitHub Actions](), [GitHub](), [CI/CD](), [Security]() Tags: [blockchain](), [c2](), [chaindrop](), [ci](), [claude-code](), [developer-tooling](), [ethereum](), [github](), [github-actions](), [high-profile-threats](), [infrastructure](), [malware](), [security](), [ssh](), [supply-chain](), [tokens]() ### AI overview This article analyzes ChainDrop, a self-propagating npm worm that infected more than 400 packages and threatened developer workstations, CI pipelines, cloud environments and downstream users. It describes credential and token theft, GitHub Actions runner memory extraction, package republishing, persistence through developer and AI coding tools, blockchain-based C2 resolution, and C2 reconfiguration through an Ethereum transaction. ### Source excerpt Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42. ## The npm worm that installs itself into your coding agent DevFeed: [The npm worm that installs itself into your coding agent]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-06T15:20:55Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [npm](), [Claude Code](), [Visual Studio Code](), [GitHub](), [JavaScript](), [Command-line interface]() Tags: [agent](), [claude-code](), [code](), [github](), [hooks](), [npm-worm](), [repo](), [shai-hulud](), [vscode](), [worm]() ### AI overview The article analyzes a Shai-Hulud npm worm that plants executable hooks in .claude/settings.json and .vscode/tasks.json. Opening a compromised repository can trigger the payload in VS Code or Claude Code, creating an attack path that install-time defenses may not detect. ### Source excerpt A Shai-Hulud wave plants hooks in .claude/settings.json and .vscode/tasks.json, so opening a repo runs the payload. Agent config is executable surface now. ## Marketplace integrations now install provider skills DevFeed: [Marketplace integrations now install provider skills]() Original publisher: [Read original article]() Author: Jathin Singaraju Published: 2026-08-06T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Agent Skills](), [Vercel](), [Command-line interface](), [npm]() Tags: [agent-skills](), [cli](), [integrations](), [npm](), [skills](), [update](), [vercel]() ### AI overview Vercel Marketplace integrations installed through the Vercel CLI now also install the provider's agent skills from skills.sh when available. The update lets agents use an integration immediately, and adds terminal commands for discovering providers and listing Marketplace categories. ### Source excerpt When you install a Vercel Marketplace integration from the Vercel CLI, it now also installs that provider's agent skills from skills.sh, so your agents know how to use it: This happens automatically for any provider that publishes skills. You can also find integrations without leaving the terminal: vercel integration discover browses available providers. vercel integration categories lists all the Marketplace categories they're grouped into, like databases, AI, and observability. Update to the latest Vercel CLI with npm i -g vercel@latest, then read the integration documentation to get started. Read more ## The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign DevFeed: [The keyv and cacheable npm Supply Chain Attack: Inside the Mini Shai-Hulud Campaign]() Original publisher: [Read original article]() Published: 2026-08-04T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [npm](), [Malware](), [chainguard](), [GitHub](), [C2](), [Ethereum]() Tags: [aws](), [chainguard](), [ethereum](), [github](), [malware](), [mini-shai-hulud](), [npm](), [payload](), [shai-hulud](), [smart-contract](), [supply-chain]() ### AI overview The article examines a 2026 npm supply-chain attack in which a compromised maintainer account was used to publish malicious versions of keyv and cacheable-related packages. It reports credential theft, worm-like propagation to hundreds of downstream packages, and command-and-control infrastructure discovered through an Ethereum smart contract. It also explains that Chainguard customers were protected by malware scanning and package cooldowns. ### Source excerpt The latest npm supply chain attack hit keyv and cacheable. See how Chainguard's malware scanning and cooldowns kept customers protected. ## How to Automate Artifact Cleanup in Harness Artifact Registry Without Breaking Production DevFeed: [How to Automate Artifact Cleanup in Harness Artifact Registry Without Breaking Production]() Original publisher: [Read original article]() Author: Shibam Dhar Published: 2026-08-04T00:00:00Z Content type: tutorial Language: en Sources: [Harness Blog]() Topics: [container images](), [Docker](), [Maven](), [npm](), [Helm charts](), [Python](), [CI/CD](), [sdlc](), [Microservice]() Tags: [ci-cd](), [cleanup](), [container-images](), [cost](), [deployment](), [docker](), [helm](), [npm](), [python](), [sdlc]() ### AI overview This hands-on walkthrough explains how Harness Artifact Registry lifecycle rules can automate cleanup across Docker, npm, Maven, Python, and Helm repositories while reducing the risk of deleting artifacts still used in production. It describes dry-run previews, governance tiers, recovery, and the limits of age-, count-, and tag-based rules. ### Source excerpt A hands-on walkthrough of Lifecycle Rules across Docker, npm, Maven, Python, and Helm. Includes dry-run preview, three-tier governance, and one-click recovery. | Blog ## pnpm vs. npm: Which package manager should you use? DevFeed: [pnpm vs. npm: Which package manager should you use?]() Original publisher: [Read original article]() Author: Chinwike Maduabuchi Published: 2026-07-28T13:00:17Z Content type: article Language: en Sources: [LogRocket Blog]() Topics: [npm](), [Security](), [supply-chain-security](), [JavaScript](), [Application Security](), [Yarn]() Tags: [application-security](), [article](), [dev](), [javascript](), [security](), [supply-chain](), [uncategorized](), [vulnerabilities]() ### AI overview This article compares npm and pnpm as JavaScript package managers, focusing on security defaults, disk usage, dependency strictness, workspace behavior, and software supply chain risk. It explains how pnpm's content-addressable store and linked dependencies improve efficiency while stricter installation policies can make migrations more demanding. ### Source excerpt Compare pnpm and npm across security defaults, disk usage, dependency strictness, and workspace policy to decide which package manager fits your project. The post pnpm vs. npm: Which package manager should you use? appeared first on LogRocket Blog. ## How to protect an npm package from supply chain attacks DevFeed: [How to protect an npm package from supply chain attacks]() Original publisher: [Read original article]() Author: Travis Turner (richardturner@evilmartians.com) Published: 2026-07-28T00:00:00Z Content type: tutorial Language: en Sources: [Evil Martians]() Topics: [npm](), [supply-chain-security](), [Security](), [ci](), [GitHub](), [Open Source]() Tags: [2026](), [ci](), [developer-community](), [dx](), [github](), [how-to](), [javascript](), [monorepo](), [npm](), [npm-packages](), [open-source](), [performance-scale](), [security](), [supply-chain](), [supply-chain-security]() ### AI overview This tutorial explains how to protect npm packages from supply chain attacks. It covers Trusted Publishers, publishing restrictions, organization-wide 2FA, GitHub tag controls, pinned CI actions, CI security linting, cooldowns for new versions, and staged-release approval. ### Source excerpt How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings ## How to add authentication and payments to a Webflow Cloud app with Auth0 and Stripe DevFeed: [How to add authentication and payments to a Webflow Cloud app with Auth0 and Stripe]() Original publisher: [Read original article]() Author: Ismail Ajagbe Published: 2026-07-27T00:00:00Z Content type: tutorial Language: en Sources: [Webflow Blog]() Topics: [Auth0](), [stripe](), [webflow](), [Authentication](), [Next.js](), [Web](), [Node.js](), [npm](), [Workers]() Tags: [authentication](), [checkout](), [guides](), [how-to](), [integration](), [next-js](), [node-js](), [npm](), [payments](), [web](), [webflow]() ### AI overview A guide to adding Auth0 session-based authentication and Stripe Checkout payments to a Next.js app hosted on Webflow Cloud. It covers server-side session checks, payment routes, verified webhooks, post-payment provisioning, and Webflow Cloud-specific deployment requirements. ### Source excerpt Learn how to add Auth0 authentication and Stripe Checkout to a Webflow Cloud app, with session middleware, a payment route, and verified webhooks. ## 🍔🧠 Why Linear Feels So Fast (Technical Breakdown) DevFeed: [🍔🧠 Why Linear Feels So Fast (Technical Breakdown)]() Original publisher: [Read original article]() Author: Alexandre Zajac Published: 2026-07-20T15:30:40Z Content type: article Language: en Sources: [Hungry Minds]() Topics: [Caching](), [Local-First](), [client](), [WebSocket](), [Software Engineering](), [Vite](), [npm]() Tags: [cache](), [caching](), [javascript](), [linear](), [local-first](), [npm](), [technical](), [vite](), [websocket]() ### AI overview A technical breakdown of how Linear aims to feel fast by minimizing network latency. It describes local-first state updates, asynchronous synchronization over WebSocket, code splitting, parallel module loading, service-worker precaching, and separately cached dependency chunks. ### Source excerpt PLUS: Virtual memory explained 👨💻, Spark retires vector DBs 💾, Backprop explained simply 🧮 ## Faster, predictable project linking in the Vercel CLI DevFeed: [Faster, predictable project linking in the Vercel CLI]() Original publisher: [Read original article]() Author: Jeff See Published: 2026-07-15T00:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Command-line interface](), [Vercel](), [releases](), [Release notes](), [ci](), [Git](), [npm]() Tags: [ci](), [cli](), [dev](), [git](), [npm](), [release](), [release-notes](), [vercel](), [workflows]() ### AI overview Vercel CLI 55 improves project linking by resolving the team before searching for projects and by using consistent team and project selection rules across linking commands. It adds more predictable behavior for local, CI, and agent workflows, including promptless linking with explicit organization and project identifiers, and introduces breaking changes requiring explicit team selection in some scripts. ### Source excerpt The Vercel CLI now resolves your team before discovering projects, then searches for projects only in that team instead of sweeping every team you belong to. Linking is faster and more predictable, and every command that establishes a link (vercel link, deploy, pull, dev, and git connect) follows the same flow: Teams resolve from an explicit signal (such as --team, --scope, the scope field in vercel.json, or VERCEL_ORG_ID), if you only have one team, or from a searchable picker. Project suggestions begin with projects already linked to your local Git repository, then fall back to an exact folder-name match before opening up search and project creation across the team. The --yes flag answers confirmations without ever selecting a team for you. For CI and agent workflows, setting VERCEL_ORG_ID and VERCEL_PROJECT_ID makes vercel link fully promptless, while --team or --scope settles the team on any command. When more than one team is available and no signal is set, non-interactive commands fail with an action_required: missing_scope error (JSON output) before they create anything or touch an existing link. Vercel CLI 55 is a major version bump and includes breaking changes. If a script relied on --yes or your globally selected team to pick where a project links, pass the team explicitly: See the vercel@55.0.0 release notes for the full list of changes. Update the Vercel CLI to v55.0.0 or later with npm i -g vercel@latest to get started. Learn more about project linking. Read more ## Compromised AsyncAPI npm packages: inside a CI supply-chain attack DevFeed: [Compromised AsyncAPI npm packages: inside a CI supply-chain attack]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper, Sebastian Obregoso, Eslam Salem Published: 2026-07-14T00:00:00Z Content type: article Language: en Sources: [Datadog Security Labs]() Topics: [npm](), [Malware](), [ci](), [GitHub](), [C2](), [JavaScript](), [Cryptography](), [IPFS](), [P2P](), [cloud-infrastructure](), [Nostr]() Tags: [c2](), [ci](), [cryptography](), [github](), [go](), [infrastructure](), [javascript](), [malware](), [network](), [npm-packages](), [supply-chain]() ### AI overview This security article examines a CI supply-chain attack in which four compromised @asyncapi npm packages distributed credential-stealing malware. It traces the injected GitHub code, its IPFS-hosted second stage, encrypted configuration, credential harvesting, persistence mechanisms, and resilient command-and-control channels. ### Source excerpt On July 14, 2026, four npm packages in the @asyncapi namespace, totaling over 3 million weekly downloads, were compromised to deliver credential-stealing malware. We investigate how the attack unfolded and how to know if you're affected. ## Automating Conversion of reveal.js Slides to PDF DevFeed: [Automating Conversion of reveal.js Slides to PDF]() Original publisher: [Read original article]() Author: Jan-Piet Mens Published: 2026-07-10T22:00:00Z Content type: article Language: en Sources: [Jan-Piet Mens]() Topics: [Automation](), [Emacs](), [Org mode](), [HTML](), [make](), [browser](), [Chrome](), [Command-line interface](), [Docker](), [npm](), [Script](), [Server]() Tags: [automation](), [browser](), [chrome](), [command-line](), [docker](), [emacs](), [html](), [jan-piet-mens](), [jpm](), [jpmens](), [make](), [npm](), [script]() ### AI overview The author describes using Emacs Org-mode and reveal.js to create training slide decks, then automating their conversion from HTML to PDF with decktape. They compare Docker-based and local installations, noting differences in Chrome and font rendering, and use a small shell script to run an HTTP server, invoke decktape, and clean up the process. ### Source excerpt A few years ago I began using Emacs Org-mode and reveal.js to generate slide decks I use in trainings, and I've been pleased with the results. (I believe it was Carsten who got me hooked.) It took me a bit to get the settings just the way I wanted to have them, but since then it's been a matter of typing make in a command line to generate the HTML from the .org file using this in my Makefile, and the resulting *.html is what I open in a browser for display. presentation.html: presentation.org emacs -u jpm \ --batch presentation.org \ --eval '(load user-init-file)' \ -f org-reveal-export-to-html For printing and handouts I want a PDF, but that's always required a bit of manual work to convert the HTML to PDF, because the tools I tried back then didn't produce the result I could get manually by opening in a Chrome browser with a ?print-pdf attached the the URL and then a judicious print-to-PDF and save. My idea was to automate that, and I was prompted a few days ago to revisit decktape. I shy away from installing NPM stuff because like Maven, Rust, and whatnot, they typically make me download half an internet, so I began by using the docker image as described at decktape. However I disliked the fonts and the overall impression of the generated PDF. "Disliked" is possibly unfair, but it just looked different... It dawned on me then, obviously, that the docker image was running some incantation of Chrome on Linux, whereas I'm used to Chrome on Mac and its fonts, etc., so I then did actually install decktape locally with the resulting PDF looking exactly like what I was used to! I've now got "automation" to (mostly) get the PDF output the way I wish to have it with a small script I've named runoff.sh (yes, the name is intentional :-) #!/bin/sh set -e python3 -m http.server --bind 127.0.0.1 8108 & httpid=$! trap "{ echo Killing http.server on $httpid; kill $httpid; exit 0; }" 0 1 2 15 echo PID=$httpid npm exec decktape -- \ --size 998x780 \ --pdf-author "Jan-Piet Mens" \ -- ## Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor DevFeed: [Not-so-anonymous telemetry: The @injectivelabs/sdk-ts backdoor]() Original publisher: [Read original article]() Author: Sebastian Obregoso, Christophe Tafani-Dereeper, Eslam Salem Published: 2026-07-09T00:00:00Z Content type: news Language: en Sources: [Datadog Security Labs]() Topics: [backdoor](), [SDKs](), [Blockchain](), [Malware](), [Git](), [npm](), [Bitcoin](), [TypeScript](), [servers](), [ci](), [Prettier]() Tags: [backdoor](), [bitcoin](), [blockchain](), [ci](), [code](), [git](), [github](), [http](), [malware](), [server](), [telemetry](), [typescript]() ### AI overview A malicious commit briefly compromised the Injective blockchain's @injectivelabs/sdk-ts npm package by disguising a credential-stealing backdoor as telemetry code. The malware captured wallet mnemonic seed phrases and private keys, encoded them, and exfiltrated them through HTTP requests to a remote endpoint before the code was reverted. ### Source excerpt A malicious commit disguised as SDK telemetry briefly compromised @injectivelabs/sdk-ts, exfiltrating wallet mnemonics and private keys. ## Announcing TypeScript 7.0 DevFeed: [Announcing TypeScript 7.0]() Original publisher: [Read original article]() Author: Daniel Rosenwasser Published: 2026-07-08T15:58:29Z Content type: release Language: en Sources: [TypeScript]() Topics: [JavaScript](), [Tooling](), [Go](), [npm]() Tags: [ai-agent](), [code](), [development](), [go](), [javascript](), [release](), [tooling](), [typescript]() ### AI overview TypeScript 7 is announced as a native Go port designed to make the TypeScript toolset substantially faster. The release adds native-code speed, shared-memory multithreading, optimizations producing reported full-build speedups of 8x to 12x, npm distribution, and improved editor support through LSP. ### Source excerpt Today we are proud to announce the availability of TypeScript 7, a 10x faster native port of TypeScript! Since its early days, TypeScript has promised to deliver on JavaScript that scales. By bringing strong type-checking and rich tooling to the world of JavaScript, TypeScript made it possible to build non-trivial high-quality apps across platforms. Last [...] The post Announcing TypeScript 7.0 appeared first on TypeScript. ## Vercel acquires Better Auth to accelerate open source auth DevFeed: [Vercel acquires Better Auth to accelerate open source auth]() Original publisher: [Read original article]() Author: Guillermo Rauch Published: 2026-07-07T07:00:00Z Content type: release Language: en Sources: [Vercel News]() Topics: [Vercel](), [Authentication](), [Open Source](), [TypeScript](), [npm](), [Next.js](), [Nuxt.js](), [vercel ai sdk](), [GitHub]() Tags: [agent](), [agentic](), [authentication](), [github](), [npm](), [open-source](), [typescript](), [vercel]() ### AI overview Vercel is acquiring Better Auth, an open source TypeScript authentication library, while its founder and core team join Vercel to continue developing the project and agent identity capabilities. ### Source excerpt Vercel is acquiring Better Auth, the company behind the open source TypeScript authentication library, which has 4.7M+ weekly npm downloads and more than 850 contributors. Founder Bereket Engida and the core team are joining Vercel to continue their work on Better Auth and agent identity. The open web Last year, we published our approach behind Next.js, AI SDK, and Nuxt: software that's open by default, loosely coupled, and portable to any platform. Better Auth applies it to authentication: framework-agnostic, runs anywhere, and gives developers auth they own. Agent identity When an agent acts on your behalf, it runs under your identity and access, so every service it touches sees you, not the agent. There's no clean way to limit what any one agent or subagent can do, or to shut down just one without cutting off the rest. The Better Auth team has been building Agent Auth so that each agent can carry its own identity and its own scoped, revocable authority, with you as the single point of control. Agent identity is foundational to agentic infrastructure. The Better Auth team will continue that work at Vercel, bringing agent identity to Vercel Connect and eve. What's next for Better Auth The library remains free and open source under MIT, retains its name, and the team continues to lead development with the same open contribution model, community governance, and framework support across the ecosystem. Read the announcement on the Better Auth blog. Explore the Better Auth documentation and the Agent Auth Protocol, or contribute to the project on GitHub. Read more ## Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more DevFeed: [Introducing GuardDog 3.0: A new rules engine, transparent sandboxing, and more]() Original publisher: [Read original article]() Author: Christophe Tafani-Dereeper, Sebastian Obregoso Published: 2026-06-26T00:00:00Z Content type: release Language: en Sources: [Datadog Security Labs]() Topics: [Malware](), [Open Source](), [Python](), [Code](), [Script](), [npm](), [Process](), [Command-line interface](), [JSON]() Tags: [cli](), [code](), [malware](), [open-source](), [process](), [python](), [release](), [tool]() ### AI overview GuardDog 3.0 is an open-source tool for identifying malicious PyPI and npm packages. The release replaces Semgrep-based scanning with YARA rules run through yara-python, and introduces a risk engine that correlates weak signals to assess whether packages are likely malicious or benign. It also addresses scale and detection challenges involving package metadata, execution vectors, and credential access. ### Source excerpt Release of GuardDog 3.0, an open-source tool to identify malicious packages, featuring a new YARA-based rules engine, a risk scoring engine, and built-in sandboxing. ## AI coding tools can increase dependency and npm supply-chain risks DevFeed: [AI coding tools can increase dependency and npm supply-chain risks]() Original publisher: [Read original article]() Author: Shibam Dhar Published: 2026-06-22T00:00:00Z Content type: article Language: en Sources: [Harness Blog]() Topics: [ai-coding](), [Security](), [npm](), [Open Source]() Tags: [ai](), [ai-coding](), [npm](), [open-source](), [security](), [social-engineering](), [supply-chain-attacks]() ### AI overview The article explains that AI coding assistants can rapidly introduce vulnerable, malicious, or non-compliant open-source dependencies. It presents Harness Artifact Registry's Dependency Firewall as a registry-level control point for evaluating and blocking risky packages before they enter a CI/CD pipeline. ### Source excerpt AI coding tools can introduce vulnerable dependencies fast. Learn how dependency firewalls block risky packages at the registry level. Explore now. | Blog ## Claude Code learning hub DevFeed: [Claude Code learning hub]() Original publisher: [Read original article]() Author: Jeff Morhous Published: 2026-06-20T12:11:50Z Content type: article Language: en Sources: [The AI-Augmented Engineer]() Topics: [Claude Code](), [Terminal](), [Command-line interface](), [npm]() Tags: [claude-code](), [guides](), [install](), [npm](), [terminal]() ### AI overview A collection of Claude Code guides gathered from the newsletter archive, including instructions for installing Claude Code with npm through a terminal. ### Source excerpt Every article the newsletter has about Claude Code ## Announcing TypeScript 7.0 RC DevFeed: [Announcing TypeScript 7.0 RC]() Original publisher: [Read original article]() Author: Daniel Rosenwasser Published: 2026-06-18T14:31:17Z Content type: release Language: en Sources: [TypeScript]() Topics: [TypeScript](), [Go Language](), [Compiler](), [build times](), [npm](), [vs-code](), [Extension](), [ci]() Tags: [build-times](), [ci](), [development](), [extension](), [go](), [performance](), [post](), [release](), [speed](), [typescript](), [vs-code]() ### AI overview TypeScript 7.0 RC introduces a Go-based compiler foundation with shared-memory parallelism, reporting substantial speed improvements while preserving TypeScript 6.0's type-checking semantics. The release candidate is available through npm, with an optional VS Code preview extension for faster editing. ### Source excerpt Today we are excited to announce the Release Candidate of TypeScript 7.0! If you haven't been following TypeScript 7.0's development, this release is significant in that it is built on a completely new foundation. Over the past year, we have been porting the existing TypeScript codebase from TypeScript (as a bootstrapped codebase that compiles to [...] The post Announcing TypeScript 7.0 RC appeared first on TypeScript. [Next page]()