--- title: Best Fireship posts — May 2026 | daily.dev description: The most upvoted Fireship posts from May 2026, curated by the daily.dev community. canonical: https://daily.dev/sources/fireship/best-of/2026/05 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/sources/fireship/best-of/2026/05 og:type: website og:site_name: daily.dev og:title: Best Fireship posts — May 2026 | daily.dev og:description: The most upvoted Fireship posts from May 2026, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of Fireship — May 2026 1. 1 [](https://daily.dev/posts/a-single-pr-just-hijacked-the-npm-registry--k7qnqnpng "A single PR just hijacked the NPM registry...") Video Fireship · 17w A single PR just hijacked the NPM registry... A sophisticated supply chain attack compromised over 100 npm packages downloaded 50 million times per week by exploiting a misconfigured GitHub Actions workflow in the TanStack repository. The attacker used the \`pull\_request\_target\` trigger, which runs fork PRs with main repo permissions, to poison the CI cache and steal an npm publish token. The malware then spread by scanning infected machines for npm tokens and republishing poisoned versions, eventually reaching packages from Mistral AI, UiPath, OpenSearch, and others. The worm embedded itself into VS Code and Claude Code, and included a dead-man switch that nukes the root directory when a stolen GitHub token expires. Mitigations include using pnpm v1+ with minimum release age, blocking exotic subdependencies, and the approved-builds feature. 171 21 2. 2 [](https://daily.dev/posts/the-forgotten-developer-who-saved-javascript--seuvsucj0 "The forgotten developer who saved JavaScript...") Video Fireship · 15w The forgotten developer who saved JavaScript... A retrospective on Jeremy Ashkenas, the largely forgotten developer who created three foundational JavaScript tools: underscore.js (utility functions), CoffeeScript (a compiled language that introduced arrow functions, classes, and destructuring to the JS world), and Backbone.js (the first MVC framework for client-side JavaScript). Each of his projects addressed a critical gap in the JavaScript ecosystem of 2009–2010, and while all three were eventually superseded, their core ideas were absorbed into modern JavaScript and the frameworks that followed. 155 12 [See all Fireship archives](/sources/fireship/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/sources/fireship/best-of/2026/05#page","url":"https://daily.dev/sources/fireship/best-of/2026/05","name":"Best Fireship Posts — May 2026","description":"The most upvoted Fireship posts from May 2026, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/sources/fireship/best-of/2026/05#items","numberOfItems":2,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/a-single-pr-just-hijacked-the-npm-registry--k7qnqnpng","name":"A single PR just hijacked the NPM registry..."},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/the-forgotten-developer-who-saved-javascript--seuvsucj0","name":"The forgotten developer who saved JavaScript..."}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sources","item":"https://daily.dev/sources"},{"@type":"ListItem","position":3,"name":"Fireship","item":"https://daily.dev/sources/fireship"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/sources/fireship/best-of"},{"@type":"ListItem","position":5,"name":"May 2026"}]}]} ```