npm and pnpm Introduce Staged Package Publishing
Staged publishing lets you upload to the registry, verify, then promote — reducing supply-chain blast radius. Plus pnpm 11.3 trustLockfile and npm 12 prerelease.
Yevhen Stuzhuk - Personal Portfolio
I am a Senior Software Engineer
← All posts
Tag
Node.js
All blog posts with this tag.
layercache: stopping cache stampedes in Node.js
L1 + Redis, single-flight, and graceful degradation — layercache benchmarks against thundering herds.
Why BullMQ beat in-API file conversion
Sync conversion in HTTP vs a Redis queue: p95 dropped from 800ms to 3.8ms, throughput rose 4.8×—plus the complexity trade-off.
Three SQL Injection Patterns That Still Ship in Node.js
Concatenation, template literals, and innocent-looking sql variables — why reviews miss them and how eslint-plugin-pg catches them statically.
Node.js: Factory and Strategy for a cross-platform npm package
EADDRINUSE on Windows, macOS, and Linux without OS if/else chains. Strategy, Factory, TypeScript contracts, and shell-injection-safe runners.
Node.js and banning AI code in core: the 19,000-line debate
A huge model-written PR, CLAs, and maintainer burnout — not «anti-AI», but review process for critical infrastructure.
Validating environment variables in TypeScript
A schema for .env, CI checks, and generated types — catch PORT=abc and empty API_KEY before deploy.
JWT in Node.js: five mistakes that break your API
Base64 is not encryption, alg=none, weak secrets, and refresh without rotation — a pre-production checklist for JWT auth.
npm supply chain attacks: hardening installs at project level
ignore-scripts, npm ci, provenance, and lockfile review—layered defenses when node_modules holds thousands of transitive packages.
7 hidden security risks in Node.js applications
ReDoS, npm supply chain, prototype pollution, secrets in env, and NoSQL injection — a checklist teams often skip after a fast deploy.
JavaScript backends: the full-stack tax
Node.js vs Go/Rust throughput and memory, npm risk, and when a single language stack still wins.