🗞️ Tech Briefing — Thursday, May 15, 2026

Your daily signal from the noise. New brief every day at 8 AM IST.

🔐 Security

TanStack npm Package Hijacked in Supply Chain Attack

Snyk Blog · May 15, 2026

A malicious actor hijacked the TanStack npm package, potentially leaking OpenAI API keys and other secrets from developer machines. Verify your lockfiles before coding today.

OpenAI Data Exfiltrated via TanStack Compromise

TechCrunch · May 15, 2026

Follow-up to the TanStack attack — OpenAI confirmed that some internal data was exfiltrated via the compromised package. No user data affected, but a wake-up call for supply chain hygiene.

Nginx-Rift Public PoC Exploit Released

The Hacker News · May 14, 2026

A public proof-of-concept for the Nginx-Rift vulnerability is now circulating. If you're running nginx in production, patch immediately.

⚛️ JS / React / Frontend

Remix 3 Drops React Entirely — Goes Framework-Agnostic

Remix Blog · May 14, 2026

Remix 3 removes the React dependency, becoming a pure web standards router that works with any UI library. A significant philosophical shift from the team.

Node.js 26.0 Ships Temporal API Natively

Node.js Blog · May 14, 2026

No more Temporal polyfills — Node 26 ships it natively. Date/time handling in JavaScript is finally getting the overhaul it deserved.

Bun Core Rewrite in Rust Merged

GitHub / oven-sh/bun · May 13, 2026

The long-running Bun core rewrite in Rust has been merged. Benchmarks show 2-3x cold start improvement in initial tests.

🤖 AI & LLMs

OpenAI Codex Now on Mobile

OpenAI Blog · May 15, 2026

Codex is now available on iOS and Android via the ChatGPT app. Code review and generation from your phone — for better or worse.

Ontario Audit: AI Medical Note-Takers Hallucinate Patient Data

TechCrunch · May 14, 2026

Ontario's provincial audit found that AI-powered clinical note tools regularly fabricate patient information. A sobering reminder of where LLMs still fail consequentially.

arXiv Bans Researcher for 1 Year Over Hallucinated Citations

arXiv Blog · May 14, 2026

First known case of arXiv issuing a ban specifically for submitting papers with LLM-hallucinated citations. Academic integrity enforcement entering the AI era.

🛠️ Dev Tools & OSS

antirez Previewing DS4 — A New Database Project

antirez.com · May 14, 2026

Redis creator Salvatore Sanfilippo is building something new. DS4 is described as a "different kind of data structure server" — early preview shared on his blog.

Germany's Sovereign Tech Fund Backs KDE with €1.3M

Sovereign Tech Fund · May 13, 2026

The German government's open-source investment arm is injecting €1.3M into KDE. European public funding for open-source desktop infra is becoming a real trend.

🚀 Industry

Cerebras IPO Pops 108% on Debut — $5.5B Valuation

TechCrunch · May 15, 2026

AI chip startup Cerebras went public and doubled on day one, reaching a $5.5B market cap. The AI infrastructure investment cycle is alive and well.

💡 Today's Signal

The TanStack supply chain attack is the most actionable story today. Before you open your IDE: run npm audit, check your lockfile, and verify you haven't pulled a poisoned package. Supply chain attacks are now targeting the exact tools you use daily — not just obscure dependencies.

Sources: Snyk, TechCrunch, Node.js Blog, Remix Blog, OpenAI Blog, antirez.com, arXiv