React Status issue #486 covers TanStack Table v9 and Next.js 16.3 highlights, including Vercel's guide to Next.js 16.3 efficiency gains. Also featured: a new React hook for the proposed WebMCP web standard (exposing page JS functions to AI agents), Flue 2.0 agent framework using React-style hooks, Astro 7.2 with experimental incremental static builds, a critical npm supply chain attack compromising the `keyv` package and spreading to 400+ other packages, and a technique for soak-testing SPAs with Playwright to detect memory leaks.
Questions this post answers
What happened in the keyv npm supply chain attack and how many packages were affected?
The `keyv` npm package was compromised by attackers who injected a credential-stealing worm. The malware spread from `keyv` across 400+ other packages. The attack is classified as an npm supply chain attack targeting the broader JavaScript ecosystem. Developers depending on npm packages track supply chain incidents like this on daily.dev before they hit production.
What is WebMCP and how does the use-webmcp-tool React hook relate to it?
WebMCP is a proposed web standard for exposing page-based JavaScript functions so AI agents can call them. The `use-webmcp-tool` hook, created by Sarah Drasner at Google Chrome Labs, wraps WebMCP's imperative API into a React-friendly declarative hook, making it easier to integrate AI agent capabilities into React applications. Developers building AI-integrated web apps watch emerging standards like WebMCP on daily.dev.
What new feature does Astro 7.2 introduce for static site builds?
Astro 7.2 adds experimental incremental static build support, which skips regenerating prerendered pages that have not changed since the last build. This can significantly reduce build times for large static sites by only rebuilding pages with updated content. Teams shipping Astro sites keep up with build performance improvements like this on daily.dev.