#ci

1 post on this topic, newest first. all tags →

The npm worm playbook for a small team

Three self-propagating npm campaigns in twelve months: the TanStack compromise in May, ChainDrop through keyv in August, 400 plus packages backdoored from one stolen token. Auditing won't get you out of this. These are the controls that actually stop a worm at the door, with the config for each.

securitynpmsupply-chain+1 more

Aug 18, 20268 min9 min

~/tips/today — 2026-10-19

~cat tips/today

Never build an index on a live table without CONCURRENTLY

postgresqlmigrations

A plain CREATE INDEX takes a lock that blocks every write to the table for the whole build. On a big table that means minutes of outage that look like a hung app.

CREATE INDEX CONCURRENTLY orders_customer_idx ON orders (customer_id);

It's slower and can't run inside a transaction, so you'll have to tell your migration tool. If it fails halfway, it leaves an invalid index behind, so check pg_index.indisvalid and drop it before you retry.

↵ open y yesterday l ls /tips

esc close