The axios npm package was compromised via a hijacked maintainer account, deploying a cross-platform RAT to over 100 million weekly downloads; Bun v1.3.12 ships built-in WebView automation and Bun.cron() scheduling.
Addy Osmani introduces Agentic Engine Optimization (AEO) for structuring docs for AI agent consumption, and MDN rebuilds its frontend from a React SPA to Lit web components with Rspack cutting dev start time from two minutes to two seconds.
Netguru's guide defines four core design system pattern types — navigation, forms, data display, and feedback — while Squarespace shipped native video and audio lazy loading by contributing patches to Chrome 147.
CSS position:sticky gains per-axis scroll container tracking in Chrome 148, and three new CSS features — @starting-style, transition-behavior, and interpolate-size — eliminate JavaScript show/hide animations.
axios npm was compromised via a hijacked maintainer account deploying a RAT to 100M weekly downloads, and IoliteLabs VSCode extensions planted a multi-stage backdoor on 27,500 Solidity developers.
Alex Russell argues browsers and PWAs are the most powerful antitrust lever against mobile app-store monopolies, while WebAssembly WASI Preview 2 and WasmGC bring near-native edge performance to production in 2026.
TypeScript 7's Go-based compiler (Project Corsa) delivers 8-10x faster type-checking, while Biome cuts pre-commit hook times by 92% in large TypeScript monorepos.
Five Weekly Digest editions connected React governance, native toolchains, a broader web platform, and a supply-chain crisis that made verification the month's defining constraint.
Chrome 146 ships scroll-driven animations with the new trigger-scope property, while Josh W. Comeau demonstrates a pure-CSS sticky-header color-swap trick using position: sticky blockers — no JavaScript required.
Node.js patches nine CVEs across all active release lines, TypeScript 6.0 lands with built-in Temporal API types and positions itself as the final release before the Go-based Project Corsa compiler arrives in 7.0.
Storybook 10.3 introduces an MCP server for React that gives AI agents structured access to component metadata and live story previews, while Nielsen Norman Group draws a sharp line between AI-initiated generative UI and user-prompted vibe coding.
A self-propagating npm worm called CanisterWorm — spawned from the Trivy v0.69.4 supply-chain compromise — is backdooring packages across the ecosystem, while GitHub begins using Copilot Free and Pro interaction data for model training starting April 24.
