<p><strong>TLDR:</strong> The axios npm package was compromised on March 30-31 with a remote access trojan, and anyone who installed the affected versions should treat their machines as compromised. ESLint v10 is out and the eslintrc system is finally gone for good. Cloudflare shipped EmDash, an open-source CMS built on Astro with sandboxed plugin isolation. Clerk raised its free tier to 50K monthly active users and dropped the app limit entirely.</p>
<hr>
<h2>Axios supply chain attack</h2>
<p>Two malicious axios versions (1.14.1 and 0.30.4) were live on npm for roughly 39 minutes after an attacker hijacked the primary maintainer’s account. The attack introduced a fake dependency containing an obfuscated postinstall script that deployed a cross-platform RAT. What makes this one worth paying attention to: the attacker pre-published a clean version of the fake package first to avoid detection, then flipped it — a level of patience that suggests this wasn’t opportunistic. If you ran <code>npm install</code> during that window, rotate your credentials and consider the machine compromised. Laravel has already pinned axios to safe versions and enabled <code>--ignore-scripts</code> by default.</p>
<h2>ESLint v10 ships, legacy config is gone</h2>
<p>The eslintrc system is fully removed in v10 — no compatibility layer, no fallback. Config file lookup now starts from each linted file’s directory, which is a meaningful improvement for monorepos. JSX identifiers are now tracked as variable references, which kills a long-standing class of false positives in <code>no-unused-vars</code>. Node.js support is narrowed to <code>^20.19.0 || ^22.13.0 || &gt;=24</code>. There are known compatibility issues with <code>eslint-plugin-react</code> and <code>eslint-config-next</code>, so check those before upgrading. A migration tool is available via <code>npx @eslint/migrate-config</code>.</p>
<h2>Cloudflare releases EmDash CMS</h2>
<p>EmDash is a v0.1.0 developer preview of an open-source CMS built entirely in TypeScript on Astro 6.0, released under MIT. The headline feature is plugin isolation: each plugin runs in its own Cloudflare Dynamic Worker sandbox and has to explicitly declare what it needs access to. That’s a real architectural improvement over WordPress, where any plugin gets unrestricted database and filesystem access by default. It’s early — v0.1.0 territory — but the sandboxing model is the part worth watching. It also includes passkey auth, WordPress content migration support, and an MCP server for agent-driven site management.</p>
<h2>Clerk Core 3 and new pricing</h2>
<p>Clerk’s free tier now covers 50,000 monthly active users, up from 10,000, and all plans support unlimited applications. Core 3 brings breaking changes: a new unified <code>Show</code> component replaces <code>SignedIn</code>, <code>SignedOut</code>, and <code>Protect</code>; concurrent rendering and suspense support land; and there’s a new interactive theme editor for built-in components. Keyless mode now works with TanStack Start and React Router. Automated migration to the new pricing happens in April, so manual migration beforehand is the safer path.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>GLM-5V-Turbo on Vercel AI Gateway:</strong> <a href="http://Z.ai" target="_blank" rel="noopener nofollow">Z.ai</a>’s multimodal vision model is now accessible via <code>zai/glm-5v-turbo</code> in the AI SDK, with no separate provider account needed and no usage markup.</li>
<li><strong>Next.js 16.2:</strong> Ships a stable Adapter API built with OpenNext, Netlify, and Cloudflare for cross-platform portability.</li>
<li><strong>TanStack RSC preview:</strong> TanStack Start previews its React Server Components implementation with a more library-like approach than Next.js.</li>
<li><strong>React Compiler in Rust:</strong> The compiler is being ported to Rust via AI assistance and already passes 100% of Babel integration tests.</li>
<li><strong>RxDB 17.0.0:</strong> Adds Google Drive and OneDrive replication plugins for serverless cross-device sync, plus a WebMCP plugin that exposes collections to AI agents.</li>
<li><strong>ESLint Markdown plugin:</strong> <code>@eslint/markdown</code> lets you lint embedded JS, JSX, and TypeScript code blocks inside Markdown files using ESLint v9.15+.</li>
<li><strong>Named useEffect functions:</strong> Naming your effect callbacks instead of using anonymous arrows makes stack traces readable and surfaces effects that are doing too much — worth the habit.</li>
<li><strong>SQL-based RAG with Claude MCP:</strong> An alternative to vector search: give Claude direct PostgreSQL access via MCP and let it write its own SQL queries. More flexible for relational data, slower and costlier than embeddings for unstructured text.</li>
<li><strong>Sycamore v0.9.2:</strong> A Rust/WASM web UI library with fine-grained reactivity, SSR streaming, and SPA mode — niche but worth knowing exists if you’re watching the WASM frontend space.</li>
<li><strong>April Fools’ roundup:</strong> The CSS Olfactive API (<code>prefers-reduced-pungency</code> included) and COBOL-Admin were the better jokes this year. The axios attack was not one of them.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A curated roundup of notable developer news: the axios npm package was compromised via a hijacked maintainer account, deploying a cross-platform RAT for ~39 minutes — any installs during that window should be treated as compromised. ESLint v10 removes the legacy eslintrc system entirely, with config lookup now starting from each file's directory and improved monorepo support. Cloudflare released EmDash, an open-source TypeScript CMS on Astro 6.0 with sandboxed plugin isolation via Cloudflare Workers. Clerk raised its free tier to 50K MAU and shipped Core 3 with breaking changes including a unified Show component and concurrent rendering. Also covered: Next.js 16.2, TanStack RSC preview, React Compiler ported to Rust, RxDB 17.0.0, and SQL-based RAG with Claude MCP.

Axios supply chain attack confirmed, ESLint v10 drops legacy config