FE Bits Vol.34 | @antv npm Supply Chain Attack, Tailwind v4.3 Released

This article has been machine-translated from Chinese. The translation may contain inaccuracies or awkward phrasing. If in doubt, please refer to the original Chinese version.

About This Newsletter

This issue's URL: https://blog.cosine.ren/post/weekly-34
This newsletter aims to be updated every Sunday.
Subscribe via RSS.
WeChat public account: FE Bits (前端周周谈 FE Bits). Click "read original" to view the source article.
QQ discussion group 598022684 / Discord server

This newsletter's content is also open-sourced at fe-bits-weekly. Feel free to follow along.

Today is May 19, 2026, Tuesday.

Personal Updates

May Day holiday was an absolute blast! Even got to meet up with Kankan and Zhizi in person. Took a huge pile of photos during the Japan trip — I won't dump them all here; I'll post a separate blog when I'm in the mood. This issue stays short.

1. Spotted a "beer trading station" while wandering Zhengjia Plaza ：I've seen plenty of the world ：Wait, this one's actually new to me — a beer trading station with price ups and downs, lol

   

2. Met up with bug-jie in person over the weekend! Super happy! The crystal bug-jie gave me is gorgeous ww

   

3. A few reflections Heard my former company laid off the entire product/R&D/design teams with n+1 — feels bittersweet, a bit of regret in there too.

The bittersweet part: I left at the end of February, didn't stick around a few more months for the year-end bonus, because I wanted to do more interesting work. Walked away decisively and joined the new company without a gap.

But I genuinely never imagined the team would just get dissolved. I was sincerely sad for a while when I left because my coworkers were great.

In other words, my job switch cost me both the year-end bonus and the n+1 severance — might be a first-in-a-lifetime experience. What happens next? I don't know. Maybe people are taking a break with the severance and then job hunting.

Back when I switched, I also felt the previous work had stopped being interesting — you could just feel it. The current job is genuinely fun and fulfilling; I'm happy across the board.

Life really is unpredictable. Sometimes I wonder if there are many "what-if" timelines.

Saw a comment I really resonated with: "Maybe if you'd stayed, you'd have missed something more important than the bonus and n+1."

At minimum, I'm in a good place at my current company and I'm content.

A few stray thoughts

Projects

Been a bit listless lately, but the vacation was great. Taking a chill approach to both new and existing projects.

Ecosystem & Community Updates

• Next.js WebSocket SSRF vulnerability CVE-2026-44578: An SSRF vulnerability in Next.js's WebSocket upgrade handler affects multiple versions — upgrade immediately.

• Bun merges the "Rewrite Bun in Rust" PR: +1,009,257 −4,024……

• Next.js Security Update | TanStack Postmortem Already covered a while back, but bundling them here makes the newsletter easier to put out (wait, am I actually updating regularly? lol)

Next.js (CVE-2026-32485/6) shipped a May 2026 security release patching 13 advisories: middleware/proxy bypass (5), denial of service (3, including the upstream React component vulnerability CVE-2026-23870), server-side request forgery (SSRF, 1), cache poisoning (2), and cross-site scripting (XSS, 2). All users on affected versions (Next.js 13.x/14.x/15.x/16.x and the corresponding react-server-dom-*) should upgrade immediately to the fixed releases (Next.js 15.5.18 or 16.2.6, with matching React versions). Only patching fully fixes the issues — WAFs cannot reliably block them.\

TanStack (2026-05-11): An OIDC token leak led to 84 packages being poisoned, all restored within an hour. The attack targeted AWS/SSH and other sensitive secrets. Only the Router/Start codebase was affected, covering 42 monorepo packages with two versions each. All packages were deprecated within an hour and subsequently removed by npm.

• Tailwind CSS v4.3 released: New color palette, high-performance webpack plugin, scrollbar styling, container sizing, and more.

• @antv npm package supply chain attack: AntV packages on npm were injected with malicious code that exfiltrates environment variables and npm tokens.

Articles

• How to control infinite CSS animations: Uses animation-composition: add to stack two identical animations, enabling infinite animations to be sped up, slowed down, stopped, or reversed.

• PL Nerd faces a seismic shift, Vibe Coder gets AI-native — a Zhihu article: Absolutely wild hhhhh

• A deep dive into local-first web development architecture: Battle-tested analysis of local-first architecture covering core concepts, storage options, sync and conflict resolution, and engineering trade-offs.

• Square dot backgrounds with conic-gradient: Explores how to use conic-gradient to efficiently produce a repeating grid of square dots on a transparent background.

• Smoothly starting and stopping infinite CSS animations: Combines animation-play-state with transition to smoothly start and stop infinitely looping animations.

• Building callout UIs with CSS offset and border: Uses offset-path and border tricks to build flexible callout components that automatically follow a border.

• Exploring the HTML-in-Canvas proposal: A deep look at the WICG proposal to render HTML elements directly inside <canvas> while preserving CSS styling and accessibility.

• Meet your users where they are with Obs.js: Context-aware performance optimization by dynamically adapting the web experience based on browser signals (network, battery, etc.).

• What's new in Node.js 26: Stable Temporal API, the Map.getOrInsert syntactic-sugar method, V8 14.6, and more.

• Hidden pitfalls of cross-document view transitions: Avoid the traps of outdated tutorials — covers timeout behavior, image stretching, and the pagereveal/pageswap events in detail.

CSS Features

• CSS Gap Decorations now stable: Chrome 149 natively supports adding dividers to Flex/Grid gaps — say goodbye to pseudo-elements and border hacks.

• Safari 26.5 CSS feature overview: Brings the :open pseudo-class, element-scoped random(), anchor positioning fixes, and more.

Tools

• Find Font — font browsing and download tool: A free font browser and downloader with real-time comparison and AI pairing, featuring over 5,000 fonts.

Fun Sites

• Dave Holloway's WebGL portfolio: A highly idiosyncratic WebGL portfolio with a distinctive tiled distortion effect and rich interactive details.