5 blogs filed in this tag
npm v12 blocks install scripts, git deps, and remote tarballs by default in July 2026. How approve-scripts works, what breaks, and what it still can't stop.
AI writes, tests, and ships code now. What the research shows about bias, insecure output, and who is accountable when an agent breaks production.
Server Actions are no longer an RSC escape hatch. They are the de facto mutation transport, and the libraries built on top reveal what is missing.
On May 11, 2026, TeamPCP hijacked TanStack's release pipeline using GitHub Actions cache poisoning and OIDC token memory scraping to forge SLSA Build Level 3 provenance.
Vercel shipped 13 advisories on May 7 — DoS, SSRF, cache poisoning, auth bypass, XSS. The pattern reframes RSC as a public API.