Veliora Engineering notes Small, reproducible experiments on how software gets built: AI-assisted development, dependencies, tooling and more. https://veliora.works/engineering/ 2026-10-08T18:00:00+01:00 https://veliora.works/favicon.svg Would npm 12 and a seven-day cooldown have stopped this year's npm attacks? https://veliora.works/engineering/npm-12-cooldown-2026-attacks/ 2026-10-08T18:00:00+01:00 2026-10-08T18:00:00+01:00 Daniel Chen Would npm 12's default block on install scripts and a cooldown on new releases have stopped 2026's malicious npm releases, and what does a cooldown cost in delayed security fixes? 12,693 OSV records, registry metadata and 761 fixes in top packages. Do Agent Skills pay for themselves? A paired test of SKILL.md on real tasks https://veliora.works/engineering/do-agent-skills-pay-for-themselves/ 2026-10-08T10:00:00+01:00 2026-10-08T10:00:00+01:00 Daniel Chen On tasks that depend on house rules, does giving Claude Code a SKILL.md change pass rate, cost and time? Claude Opus 5.5 and Sonnet 5.5 (plus Haiku 5.5), with compact, long and self-written skills.