npm to Implement 'Staged Publishing' After Turbulent Shift Off Classic Tokens — 2025 was a tricky year for the npm ecosystem with phishing attacks, Shai Hulud, and changes to npm’s token system. For 2026, GitHub has announced even more changes for publishing npm packages with a new ‘staged publishing’ model that will introduce a review period before packages go live.

Sarah Gooding (Socket)

Finally: A Database AI Agents Can Actually Use — Let your AI agents work directly with PostgreSQL, safely. Instant database forks for testing, native vector search for RAG, built-in guardrails for production. Agentic Postgres handles the complexity so your agents can focus on solving problems.

Tiger Data (creators of TimescaleDB) sponsor

require(esm) in Node: From Experiment to Stability — Joyee Cheung is a long-standing core Node.js contributor and largely responsible for Node’s support for require(esm) (i.e. the ability to load ES modules using require). In this new two-part series, she explains what it took to make require(esm) happen and the details of its implementation.

Joyee Cheung

Fixing TypeScript Performance Problems: A Case Study — A big monorepo-based TypeScript project was suffering sluggish IntelliSense, long type-checking times, and slow builds, but Solomon’s team found some ways to significantly improve things.

Solomon Hawk

npmgraph: A Tool to Visualize npm Module Dependencies — Give this Web-based tool one or more npm package names (or a package.json file) to see a visualization of the dependency graph for packages, including where they intersect. Packages can be colored by various criteria (like number of maintainers) and you can download an SVG of the resulting graphs.

Kieffer, Brigante, et al.

Fabric.js 7: A JavaScript HTML5 Canvas Library — Suitable for both browsers and Node (thanks to node-canvas), Fabric provides an object model on top of canvas elements, as well as SVG-to-canvas and canvas-to-SVG features. There are also lots of demos, complete with code, to enjoy.

Bogazzi, Nen, et al.

Stop Credential Stuffing Attacks — Clerk's Free Client Trust Feature — Automatic 2FA on untrusted devices when valid passwords are used. No config needed. Free for all Clerk plans.

Clerk sponsor