SDSashank Debinsashankdeb.hashnode.dev·2d ago · 6 min readReact-Liquid-FillIt started with a row of dull icons Almost every portfolio, landing page and docs site I've built has the same row: the tech stack. A set of SVG logos, sitting there in flat grey or full colour, doing10
JCJoel Cheninjchip.hashnode.dev·Oct 7 · 15 min readRust vs Node.js for a package manager - tuning fyn on pnpm benchmarksRecently I caught the news that pnpm was rewritten in Rust, and I checked it out. It also stirred my interest in an old project of mine: fyn and fynpo. While Rust definitely makes the most of memory, 00
APAkash Palinblogs.akashpal.dev·Oct 4 · 2 min readWhy I'm building an HTML to PDF tool that works in every languageI'm building a tool that turns HTML into a PDF. It isn't released yet. A beta is coming soon, and I want to share the story from the start. How it started In one of my personal project, AI Question Ge22AR
JTJAY TANKinjaytank.hashnode.dev·Oct 1 · 10 min readHow to fix package-lock.json merge conflicts (and yarn.lock, poetry.lock, go.sum) the right wayYou rebase your feature branch on main, and git stops halfway: CONFLICT (content): Merge conflict in package-lock.json error: could not apply 3f2c1a9... add date-fns You open the file and there it is00
MTMuhammad Tahirinmtdeveloper.hashnode.dev·Sep 24 · 12 min readModern Open-Source Maintenance: Secure Package Publishing, SemVer, and Automated ScanningThis article was originally published on Muhammad Tahir's Portfolio. Introduction & Industry Context In the modern software engineering landscape of 2026, building applications is less about writing c00
KTKhushi Trivediinkhushitrivedi.hashnode.dev·Sep 22 · 5 min readYou Chose 12 Dependencies. But Actually Shipped 1,400Open your package.json. Count the lines under dependencies. That number is not your attack surface. The number that matters is sitting in node_modules, and almost nobody has actually counted it. The t00
TSTidiane Stanoin4sapi.hashnode.dev·Sep 21 · 8 min readnpm Staged Publish: Secure CI/CD Release WorkflowIntroduction Automated release pipelines do not grant CI systems unrestricted permission to publish packages directly to public registries. GitHub and npm have introduced a new type of scoped access t00
RLRuan Lopesinhermesruanlopes.hashnode.dev·Sep 18 · 8 min readArchitecture of a Self-Hosted Transactional Email Gateway: Decoupled Workers, Argon2id, and Key RotationWhen multiple internal applications need to send transactional emails, embedding SMTP transport logic and template rendering directly into each service introduces tight coupling, unpredictable request00
RSRushabh Shahindepwarden.hashnode.dev·Sep 7 · 4 min readHow npm typosquatting and dependency confusion attacks work (and how to stop them)In February 2021, security researcher Alex Birsan published a paper describing how he had successfully deployed malicious packages to the internal build systems of Apple, Microsoft, PayPal, Shopify, a00
NPNirdesh pokharelinblog.nirdeshpokhrel.com.np·Sep 3 · 5 min readdigit-to-words-nepali: Converting Numbers to Nepali Words, ProperlyIf you've ever built a billing system, an invoice generator, or a cheque-printing tool for a Nepali audience, you already know the pain: turning 1234 into "एक हजार दुई सय चौँतिस" is not a simple looku00
