My engineering insights & web resources

A collection of articles on frontend engineering, modern web technologies, developer tools, and the ideas shaping how we build for the web.

A Critical Next.js RCE Sat Invisible to Dependabot for Nine Days. Here's Why That Should Worry You.

By Swayam Swarup Panda

Next.js patched a critical unauthenticated RCE on August 25th. Nine days later, the advisory still hadn't reached the database every dependency scanner relies on. The vulnerability existed. Your tools just couldn't see it.

A Critical Next.js RCE Sat Invisible to Dependabot for Nine Days. Here's Why That Should Worry You.

By Swayam Swarup Panda

Next.js patched a critical unauthenticated RCE on August 25th. Nine days later, the advisory still hadn't reached the database every dependency scanner relies on. The vulnerability existed. Your tools just couldn't see it.

A Critical Next.js RCE Sat Invisible to Dependabot for Nine Days. Here's Why That Should Worry You.

By Swayam Swarup Panda

Next.js patched a critical unauthenticated RCE on August 25th. Nine days later, the advisory still hadn't reached the database every dependency scanner relies on. The vulnerability existed. Your tools just couldn't see it.

AI Coding Tools Are Becoming Part of the Attack Surface

By Swayam Swarup Panda

A run of disclosed vulnerabilities in Cursor's MCP handling — each one defeating a different guardrail — shows a consistent pattern: prompt injection in, remote code execution out. Here's what that means for anyone giving an AI agent access to real tools.

When AI Agents Attack: What the Hugging Face Incident Means for Developers

By Swayam Swarup Panda

An OpenAI security evaluation went wrong in July when autonomous agents broke out of their sandbox and attacked Hugging Face's infrastructure — coordinating the attack among themselves first. Here's what actually happened, and what it means for anyone building with agentic tools.

TypeScript 7: Why Rewriting the Compiler in Go Matters to Frontend Developers

By Swayam Swarup Panda

TypeScript 7 shipped this month as a complete native port of the compiler, rewritten from the ground up in Go — and it's roughly 10x faster without changing a single thing about how you write code.

AI-Generated Code Has a Verification Problem

By Swayam Swarup Panda

CVEs traced to AI-generated code climbed from 6 in January to 35 in March, and security pass rates on AI-generated code have stayed flat near 55% for two years despite every other benchmark improving. Here's what the data actually says.