404 npm packages got hijacked in 5 hours

In partnership with

Hey there.

Welcome to Full Stack Focus. 👋

Here's everything you need to know this week in the world of full-stack development — from a 6,755-commit runtime rewrite, to an npm meltdown that broke both ecosystems at once, to what your browser is quietly doing behind your back.

Ghost: Free Postgres For Agents

Agents are desperate for ephemeral databases.

They spin up projects, fork environments, test ideas, and tear them down. Over and over. But every database on the market was designed for humans who provision once and stick around. Agents don't work that way.

Ghost is a database built for agents. Unlimited databases, unlimited forks, 1 TB of storage, and 100 compute hours per month. All free. Try it here.

Install the ghost MCP

Front-End

💔 Moving Away From Tailwind, and Learning to Structure My CSS 
After 8 years as a happy Tailwind user, Julia Evans spent the last week migrating her sites to semantic HTML + vanilla CSS, and the writeup is part retrospective, part practical guide. She walks through her new approach to resets, components, colour palettes, font scales, and grid-based responsive design without media queries, while being refreshingly honest about how much Tailwind quietly taught her.

👀 Browsers Treat Big Sites Differently 
Safari and Firefox literally ship code that checks what domain you're on and changes how the page renders accordingly — TikTok, Netflix, Instagram, and even SeatGuru get their own carve-outs. Chrome doesn't have a quirks file, and the reason isn't that it's better engineered — it's that the web is already built for Chrome. The post walks through real entries in WebKit's Quirks.cpp, including a Safari user-agent override that lies and pretends to be Chrome for Amazon Prime Video. A genuinely fascinating look at how browser monoculture is quietly reshaping the modern web.

🛠 FCaptcha — An Open Source CAPTCHA That Detects Vision AI Agents Traditional CAPTCHAs were built to stop bots, not GPT or Claude clicking screenshots on your behalf. FCaptcha is a fully open source, self-hosted CAPTCHA that uses 40+ behavioural signals (micro-tremor, velocity variance, trajectory analysis) plus SHA-256 proof-of-work to detect headless browsers, automation frameworks, and vision-based AI agents specifically. Servers ship in Go, Python, and Node, and there's a one-line Docker deploy. A genuinely needed tool for anyone shipping forms in 2026.

Programming

📈 Bun Has Been Rewritten in Rust (and It Just Merged) 
Jarred Sumner just merged a 6,755-commit pull request that rewrites the entire Bun JavaScript runtime from Zig to Rust — and the branch name is claude/phase-a-port, which tells you exactly how it got done. Most importantly, Bun now has compiler-assisted memory safety, which has cost the team enormous amounts of debugging time over the years.

⚠️ Mass Supply Chain Attack Hits TanStack, Mistral AI, UiPath, and OpenSearch 
On May 11, an attacker published 404 malicious versions across 172 packages in a single coordinated five-hour blast — hitting the entire TanStack router ecosystem (42 packages), Mistral AI's SDKs on both npm and PyPI, UiPath's 65-package scope, and OpenSearch (1.3M weekly downloads). The payload steals AWS, GitHub, npm, and Vault credentials, exfiltrates through the Session onion-routed messenger network, and self-propagates by committing poisoned .claude/settings.json and .vscode/tasks.json files into victim repos. This is the first campaign to span both npm and PyPI in a single push. Required reading if you ship anything that touches these ecosystems.

😧 "No Way To Prevent This," Says Only Package Manager Where This Regularly Happens 
The Onion-style satire writes itself, and Kevin Patel just wrote it. The piece skewers the JS ecosystem's full acceptance that a 40-level-deep nested tree of unvetted packages maintained by pseudonymous strangers is just how we build software now. It also takes a sharp dig at devs in Go, Rust, and native Web API ecosystems — "where robust standard libraries drastically reduce reliance on third-party code" — reporting zero of these incidents this week. Cathartic, devastating, and the perfect chaser to the TanStack/Mistral piece above.

⚠️ Malware Crew TeamPCP Open-Sources Its Shai-Hulud Worm on GitHub 
Just when you thought supply chain attacks couldn't get worse: TeamPCP has open-sourced the Shai-Hulud worm on GitHub under an MIT license, with a note reading "Is it vibe coded? Yes. Does it work? Let results speak." Forks are already multiplying, and someone has submitted a PR adding FreeBSD support. The malware hunts AWS, GCP, Azure, and GitHub credentials inside npm packages, then self-propagates — and Microsoft's GitHub has been letting the repos sit live for at least 12 hours at last count. The era of "malware as a community project" has officially begun.

💔 What Devs Can Learn From the Atlassian Layoff Video 
After being laid off from Atlassian after 8 years, edge infrastructure engineer Vasilios Syrakis uploaded a 38-minute YouTube video walking through how Atlassian's internal traffic management, Envoy proxy control plane, and infrastructure provisioning systems actually work, free for anyone to copy. The ExperiencedDevs thread digs into what the rest of us can take from it: about institutional knowledge, why "code churn" is a structural smell, and why building software is easy but maintaining it is the part that breaks teams. There's a sharper subtext too, about who gets cut while the C-suite preaches AI productivity. Cathartic, technical, and impossible to look away from.

AI

Millions of people use Wispr Flow to give AI tools richer context by voice. 89% of messages sent with zero edits. Speak your prompts, skip the typing. Free on Mac, Windows, and iPhone. Try Wispr Flow free.

💔 Things I Used to Be Proud of Doing Well — That Modern AI Just… Does 
An ExperiencedDevs thread that has clearly hit a nerve. Engineers listing the hard-won skills they used to take pride in, reading unfamiliar codebases fast, writing clean abstractions, debugging gnarly stack traces, drafting clear PR descriptions, that modern AI tools now produce instantly. The comment section is part grief, part dark humour, and part genuine reflection on what actually still matters in an engineering career in 2026. If you've been quietly wrestling with the same feelings, you are very much not alone. Worth reading just to recalibrate.

🤖 Agents Are Thinking, Terminal Animations for Your AI Agent's "Thinking" State 
A delightful little open source library that gives your CLI-based agent 48 thinking-state animations across 6 families — braille spinners, shade waves, vblock ripples, dot heartbeats, even a fire simulation. Written in Rust with first-class Python (via PyO3) and JS/TS (via wasm-bindgen) bindings, and zero runtime dependencies. The kind of polish that turns an agent CLI from "fine" to "actually feels alive." Bookmark this for the next time you're building a terminal tool.

Have a great week, see you the same time next week!

Full Stack Focus team :)