Supply-chain attacks and npm trust

In this panel episode, the crew discusses AI platform consolidation, open-source sustainability, and the future of web development. We break down Anthropic’s acquisition of Bun, what it means for the JavaScript ecosystem, and whether open-source projects can remain independent as AI companies invest heavily in infrastructure.

We also discuss Zig leaving GitHub, growing concerns around AI-first developer tools, npm security vulnerabilities, and supply-chain risk in modern software. The episode wraps with hot takes on AI infrastructure costs, developer productivity, and practical advice for engineers navigating today’s rapidly changing tech landscape.

Resources

Anthropic acquires Bun as Claude Code hits $1B milestone: https://www.anthropic.com/news/anthropic-acquires-bun-as-claude-code-reaches-usd1b-milestone
Zig quits GitHub, says Microsoft’s AI obsession ruined the service: https://ziglang.org/news/migrating-from-github-to-codeberg/
Shai-Hulud: 1K+ npm packages & 27K repos infected: https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24
IBM CEO says AI data center spending “won’t pay off” at current costs: https://www.businessinsider.com/ibm-ceo-big-tech-ai-capex-data-center-spending-2025-12

We want to hear from you!

How did you find us? Did you see us on Twitter? In a newsletter? Or maybe we were recommended by a friend?

Fill out our listener survey! https://t.co/oKVAEXipxu

Let us know by sending an email to our producer, Elizabeth, at elizabeth.becz@logrocket.com, or tweet at us at PodRocketPod.

Check out our newsletter! https://blog.logrocket.com/the-replay-newsletter/

Follow us. Get free stickers.

Follow us on Apple Podcasts, fill out this form, and we’ll send you free PodRocket stickers!

What does LogRocket do?

LogRocket provides AI-first session replay and analytics that surfaces the UX and technical issues impacting user experiences. Start understanding where your users are struggling by trying it for free at LogRocket.com. Try LogRocket for free today.

Chapters

01:00 – Meet the Panel: Paige, Jack, and Paul
02:00 – Anthropic Acquires Bun: First Reactions
05:30 – What the Bun Acquisition Means for JavaScript Runtimes
09:00 – Open Source Funding, Independence, and New Exit Models
14:30 – Zig Leaves GitHub: AI-First Platforms and OSS Friction
20:30 – GitHub, Copilot, and Developer Experience Tradeoffs
24:30 – npm Security, Supply Chain Attacks, and Trust at Scale
31:00 – Are We Too Dependent on Big Tech Platforms?
36:30 – AI Infrastructure Costs and the Sustainability Question
43:00 – Small Models, Local AI, and the Future of Inference
50:30 – Hot Takes: Subscriptions, Burnout, and Developer Frustration
58:30 – Security Alerts, Tooling Wins, and Final Thoughts

Special Guest: Jack Herrington.