Socket founder and CEO Feross Aboukhadijeh told AI Council 2026 that AI agents are expanding the software supply chain attack surface by selecting dependencies, connecting to MCP servers, installing s…
In May 2026, 84 malicious package versions were published through TanStack's own CI/CD pipeline with cryptographically valid SLSA provenance attestations, spreading to 169 packages and 373 malicious v…
Sebastien Lorber and Jan Jaworek's newsletter highlights Octane, a new React challenger by Dominic Gannaway that compiles Hooks, Suspense, and Actions ahead of time, removing the Virtual DOM and using…
A developer built PetVideo Generator, an AI app that turns pet photos into short cinematic videos using TanStack Start and ByteDance's Seedance 2.5. The project uses a full TanStack ecosystem includin…
Code review platform Change Stack has launched a new approach that groups diffs by system behavior rather than file changes, aiming to cut review time and bugs by 50%. The tool, described as the most …
Coding agents now generate code faster than teams can review it, creating an explainability gap that shifts the bottleneck from writing changes to understanding them, according to Harjot Gill. Gill ar…
TypeScript developers face increased risk from malicious npm packages, with the Shai-Hulud 2.0 attack in November backdooring 796 packages totaling over 20 million weekly downloads and the Mini Shai-H…
A developer has built RepCN, an open-source tool that converts React code into a deployed project with a shareable URL. The tool addresses the problem of sharing React code generated by AI assistants …
AI agents perform better when using the web's accessibility tree instead of screenshots, reducing latency from 2-5 seconds to under 500ms and cutting token costs by an order of magnitude, according to…
PostCSS maintainer Andrey Sitnik adopted npm staged publishing for four of seven packages under the 'ai' npm account, gating 685 million weekly downloads behind human approval. The move, prompted by a…
TanStack won two 2026 Open Source Awards at JSNation in Amsterdam: TanStack Start won Breakthrough of the Year and TanStack AI won AI Project of the Year. The awards highlight the open-source communit…
Docker Security Dispatch Issue 3 reports on major supply chain incidents including the TanStack and Nx Console compromise, the persistence of the Mini Shai-Hulud npm worm, and a kernel-level container…
TanStack AI reached Beta on June 9, 2026, introducing Code Mode, middleware, and host-side MCP. Code Mode lets the model write and execute TypeScript programs in a sandbox, reducing round trips, while…
OpenAI will revoke code-signing certificates for ChatGPT Desktop, Codex App, Codex CLI, and Atlas on June 26, 2026, after a supply chain attack via the Mini Shai-Hulud worm compromised employee device…
A developer detailed three vulnerabilities in the AI-coding-agent stack, including a supply chain worm that persists in developer toolchain configs, an abuse of shell built-ins to bypass Cursor's comm…
A developer studying AI and big data warns that AI is increasing cyber vulnerability in two ways: attackers using AI for more sophisticated attacks, and vulnerabilities introduced by integrating AI in…
TanStack released the Beta of TanStack AI, a framework-agnostic and provider-agnostic AI toolkit, on June 9, 2026. The update delivers stable core APIs, documented protocols, and first-class support f…
TanStack released experimental AI Workflows and Orchestrators on May 28, 2026, enabling developers to compose multi-step LLM and agent processes as TypeScript async generators with streaming, human-in…
In 2026, the combination of supply chain attacks and stale credentials is especially dangerous because attackers exploit trusted, unrotated tokens to gain long-term access to critical systems, bypassi…
TanStack's AI SDK now preserves structured output across chat turns by attaching typed data to each message, eliminating the need for manual state management. The update adds a `structured-output` par…