<p><strong>TLDR:</strong> Two malicious Axios versions were published to npm on March 31 after an attacker hijacked a maintainer’s credentials, deploying a remote access trojan via a fake dependency. Separately, a critical unauthenticated RCE in React Server Components (CVE-2025-55182) affects React 19.0 through 19.2.0 and every RSC-enabled framework. Svelte’s April update ships MCP integration and server-side error boundaries. A new CSS <code>corner-shape</code> property is landing with ~66% browser support, though Safari and Firefox aren’t there yet.</p>
<hr>
<h2>Axios npm compromise</h2>
<p>Versions 1.14.1 and 0.30.4 of Axios were published after an attacker took over a lead maintainer’s npm account, likely via a stolen long-lived access token that bypassed 2FA. The packages themselves looked clean but pulled in a fake dependency called <code>plain-crypto-js</code>, which ran a postinstall script that downloaded a RAT targeting macOS, Windows, and Linux — then deleted itself to complicate forensics. Socket caught it within minutes and Vercel blocked the C2 domain. If you ran an install during that window, check your lockfile for those versions, scan for <code>plain-crypto-js</code> in <code>node_modules</code>, rotate any secrets on affected machines, and pin to 1.14.0 or 0.30.3. Adding <code>--ignore-scripts</code> to CI npm installs is worth doing regardless.</p>
<h2>React Server Components RCE (CVE-2025-55182)</h2>
<p>This one is a CVSS 10.0 — unauthenticated remote code execution via unsafe deserialization in the React Flight protocol. Affected versions are React 19.0 through 19.2.0, and the exposure covers Next.js App Router, React Router in RSC mode, Vite RSC plugin, Parcel RSC plugin, RedwoodSDK, and Waku. You don’t need to be explicitly using Server Functions to be vulnerable; frameworks embed the RSC implementation by default. Wiz found 44% of cloud environments have publicly exposed Next.js instances. Patched releases are React 19.0.1, 19.1.2, and 19.2.1. There’s also a related DoS (CVE-2025-55184) with an incomplete initial patch, so if you patched early, check again.</p>
<h2>Svelte April 2026 update</h2>
<p>The April Svelte release adds MCP integration with OpenCode via the <code>sv</code> CLI, which is the most interesting addition for teams already running AI-assisted workflows. SvelteKit gets server-side error boundary support, which fills a real gap for SSR error handling. There’s also support for functions in <code>svelte.config.js</code> for <code>css</code>, <code>runes</code>, and <code>customElement</code> options, new exported types from <code>svelte/motion</code>, and improved type narrowing for page and layout params when using matchers.</p>
<h2>CSS corner-shape</h2>
<p>The new <code>corner-shape</code> property lets you go beyond rounded corners — <code>scoop</code> gives you an inverted radius, <code>bevel</code> cuts a straight line, <code>notch</code> inverts a square corner, and <code>super-ellipse()</code> gives fine-grained control from squircle to star-like shapes. Individual corners can be targeted independently, and shape transitions are animatable. Browser support sits at roughly 66% with no Safari or Firefox support yet, so it’s decorative-only for now, but graceful fallback makes it usable today for the right use cases.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Storybook WebSocket RCE (CVE-2026-27148):</strong> The dev server’s <code>/storybook-server-channel</code> WebSocket endpoint has no auth or origin validation, letting attackers inject arbitrary JavaScript into story source files — which then executes in Node.js when test runners like Vitest pick them up. Patched in versions 7.6.23, 8.6.17, 9.1.19, and 10.2.10.</li>
<li><strong>SvelteKit + Vercel cache deception (CVE-2026-27118):</strong> The <code>__pathname</code> query parameter in the Vercel adapter could be abused to cache authenticated responses under publicly accessible paths. Vercel has automatically patched all users.</li>
<li><strong>Astro SSRF (CVE-2026-25545):</strong> Custom prerendered error pages caused Astro to fetch itself using the user-controlled Host header, enabling full internal network access via redirect. Fixed in astro@5.17.2.</li>
<li><strong>eslint-config-prettier supply chain compromise:</strong> The maintainer was phished, leading to tampered versions that install a DLL on Windows and deploy the Pycoon info stealer via <code>got-fetch</code>. CVE-2025-54313 assigned. Pin to safe versions and audit recent Dependabot/Renovate PRs.</li>
<li><strong>Vite 8 + Rolldown benchmarks:</strong> Real-world numbers on a 180k-line TypeScript codebase show 8.5x faster production builds (94s to 11s). Safe for new projects and large slow builds; hold off if you rely on obscure Rollup plugins.</li>
<li><strong>TanStack Start import protection:</strong> New experimental Vite plugin enforces server/client boundaries via file naming conventions, with build-time errors that include the full import chain. Enabled by default in new projects.</li>
<li><strong>Pretext text layout library:</strong> 15kB TypeScript library that bypasses DOM-based text measurement entirely, using Canvas for a one-time prep pass then cheap arithmetic for layout. Claims ~500x faster than standard DOM approach, with full bidi and CJK support. Built by Cheng Lou (React, Messenger, Midjourney).</li>
<li><strong>Bun vs Node.js 2026:</strong> HTTP throughput benchmarks put Bun at ~120k req/s vs Node’s ~45k, with 4x faster startup. Native addon compatibility (bcrypt, canvas, argon2) remains the main blocker.</li>
<li><strong>Cloudflare vinext:</strong> A Vite-based Next.js reimplementation built by one engineer directing Claude Opus 4.6 over one week for ~$1,100 in API costs. Covers 94% of the Next.js 16 API surface, builds 4.4x faster, and produces 57% smaller bundles. The competitive moat in framework tooling is shifting fast.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

A security-focused roundup covering two major incidents: malicious Axios versions (1.14.1 and 0.30.4) were published to npm after an attacker hijacked a maintainer's account, deploying a RAT via a fake dependency called `plain-crypto-js`. Separately, a CVSS 10.0 unauthenticated RCE (CVE-2025-55182) was found in React Server Components via unsafe deserialization in the React Flight protocol, affecting React 19.0–19.2.0 and frameworks like Next.js App Router, React Router, and others — patched in React 19.0.1, 19.1.2, and 19.2.1. Additional items include Svelte's April update with MCP integration and SSR error boundaries, the new CSS `corner-shape` property with ~66% browser support, Storybook and SvelteKit CVEs, an eslint-config-prettier supply chain compromise, Vite 8 + Rolldown build benchmarks, and a Cloudflare engineer's Claude-assisted Next.js reimplementation.

Axios supply chain attack hits npm, React RSC gets a critical RCE patch