<h2>Must know</h2>
<ul>
<li><strong>Axios npm supply chain attack hits 300 million weekly users</strong>: A sophisticated supply chain attack compromised the npm axios HTTP client library on March 31, 2026, by hijacking a lead maintainer’s credentials. Malicious versions 1.14.1 and 0.30.4 injected a hidden dependency that deployed a cross-platform Remote Access Trojan (RAT) designed to self-delete and evade detection. Socket and Vercel flagged the malicious activity within minutes, but any developer who ran an install during the three-hour window should assume full system compromise and rotate all secrets immediately. <a href="https://app.daily.dev/feed-by-ids?id=RlEVDfzaA&amp;id=6mR1VFvvx&amp;id=Cs5sU7Y7b&amp;id=oXgVuy0gN" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Anthropic accidentally leaks Claude Code source code</strong>: On April 1, 2026, Anthropic accidentally published full source maps for Claude Code to npm, exposing approximately 500,000 lines of proprietary TypeScript. The leak, attributed to a known Bun development server bug, revealed unreleased features like ‘dream mode’ for background memory consolidation and a hidden ‘undercover’ mode that masks AI authorship in commits. Security researchers are already using the leaked internals to analyze the tool’s 23-step bash security checks and anti-distillation mechanisms. <a href="https://app.daily.dev/feed-by-ids?id=7folff4vx&amp;id=ZCefS7s98&amp;id=cLSmwFJgK&amp;id=d39v889GW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Project VAIL exposes silent behavioral drift in AI endpoints</strong>: Researchers from Project VAIL and the University of Illinois have built a black-box fingerprinting system that detects silent changes in LLM API behavior without provider cooperation. Their monitoring revealed that models like Kimi-K2 show massive behavioral shifts across different hardware providers even when weights remain identical, effectively invalidating prior safety and compliance audits. This discovery highlights a critical security gap where uptime dashboards report ‘healthy’ status while the underlying model’s reasoning and quantization have fundamentally changed. <a href="https://app.daily.dev/posts/XR04f9Sk1" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Good to know</h2>
<ul>
<li><strong>Video.js v10 Beta merges major players into a tree-shakable framework</strong>: A ground-up rewrite integrates Plyr and Vidstack, slashing default bundle sizes by 88% with unstyled UI primitives. <a href="https://app.daily.dev/posts/esarQysuG" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>TanStack Start adds experimental import protection for server client boundaries</strong>: The new Vite plugin enforces strict file naming conventions to prevent sensitive server-only code from leaking into client bundles. <a href="https://app.daily.dev/posts/1vUKo1yob" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Swiggy migrates B2B dashboards to Module Federation 2.0</strong>: The engineering team eliminated 638KB of duplicate JS per app and solved singleton traps by moving away from S3-based micro-frontends. <a href="https://app.daily.dev/posts/0IigpOvLI" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Inertia.js v3.0.0 drops Axios for a built-in XHR client</strong>: The major release adds first-class optimistic updates and SSR support in Vite dev mode without a separate Node process. <a href="https://app.daily.dev/posts/WWmxp0DEw" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>QuickBeam brings JavaScript runtimes directly into the BEAM</strong>: Each JS runtime now operates as an OTP GenServer with its own thread, enabling native clustering and supervision without Node.js. <a href="https://app.daily.dev/feed-by-ids?id=72NNkisK0&amp;id=kcgZ3hVcU" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Unity announces transition from Mono to CoreCLR for 2026</strong>: Unity 6.8 will drop Mono entirely, adopting .NET 10 and C# 14 to provide a modern garbage collector and improved JIT performance. <a href="https://app.daily.dev/posts/xeqPY9TSa" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Pulumi eliminates long-lived CI secrets across 70 repositories</strong>: By chaining GitHub OIDC tokens through Pulumi Cloud, the team now fetches ephemeral cloud credentials at runtime. <a href="https://app.daily.dev/posts/4QM6OAZyn" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
<h2>Bullshit police</h2>
<ul>
<li><strong>The tokenmaxxing leaderboard is the new lines of code</strong>: Engineers at Meta and OpenAI are reportedly competing on internal leaderboards for AI token consumption as a ‘productivity’ metric. This is a textbook case of Goodhart’s Law; when a measure becomes a target, it ceases to be a good measure. We’ve officially reached the point where burning GPU cycles to generate ‘vibe-coded’ boilerplate is being mistaken for actual engineering output. <a href="https://app.daily.dev/posts/dl9dAiLtW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>AI interview assistants are just expensive ways to fail</strong>: A new wave of ‘interview assistants’ like Final Round AI promises real-time technical answers during live calls. If you need a bot to explain a React dependency graph in real-time, you aren’t a senior engineer; you’re a script reader. These tools are a fast track to getting blacklisted by any company that actually values fundamental problem-solving over LLM-regurgitated trivia. <a href="https://app.daily.dev/posts/YaGAdbg6I" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Nvidia’s revenue per megawatt is the ultimate pivot</strong>: Nvidia is now urging AI factory operators to track ‘revenue per megawatt’ as their core business metric. It’s a brilliant way to distract from the fact that their hardware churn is creating an environmental nightmare and that most ‘AI startups’ are just burning VC cash with no path to profitability. It’s not a graphics card anymore; it’s a very expensive, very hot space heater that occasionally outputs a hallucinated JSON object. <a href="https://app.daily.dev/posts/2qZgN7UQL" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>
