The worm that infected keyv: inside August's npm supply chain attack
On 4 August the GitHub account of the keyv maintainer was compromised, 127 million weekly downloads, and within two days a self-propagating worm poisoned over 1,300 package versions. You do not need to use keyv to be hit. What we checked across client pipelines.
Observability without an enterprise budget: a stack for small teams
Logs, metrics and traces aren't a big-company luxury. Here's the cheap, lightweight stack we use to understand what happens in production.
Kubernetes for SMEs in 2026: still a sensible choice?
After five years of hype, Kubernetes in Italian SMEs is rare. Is that failure or a correct choice?
Postgres zero-downtime migrations: the patterns we actually use
Adding columns, renaming, changing types: all without service interruption. Four techniques we apply.
GitHub Actions: seven patterns for genuinely fast pipelines
Clean cache, parallel jobs, smart matrix. From 14 minutes down to 3 on a real build of ours.
