The Engineer

The failure mode is a green CI log. When npm 12 skips a postinstall, nothing throws. The install completes. The missing native binary or downloaded dependency surfaces at runtime instead, often in production. The checks your pipeline trusts pass anyway.

Who breaks

Three categories. Native compilation (node-gyp, sharp, better-sqlite3). Binary fetchers (esbuild, swc, prisma). Dev-tooling setup (husky). Anything that hangs work on a lifecycle hook now no-ops silently. Go through 11.18.0 before 12. That release carries the migration warnings and the tooling. Skip it and you lose the inventory step.

Why it's right anyway

Postinstall scripts have been the primary supply-chain vector for years. The weekend jscrambler was compromised, Socket flagged it in six minutes. Scripts-off-by-default is the systemic answer, and it lines up with the week's other toolchain moves. TypeScript 7.0's Go rewrite ships 10x compile speed without the programmatic API that ts-morph, ts-jest, and custom transformers call, so it can't land in real setups yet. Bun's $165k AI-assisted Zig→Rust rewrite shipped as 1.4, and it worked because one of the few engineers able to architecturally verify a runtime directed it. The pattern is stability and security over velocity.

An install that succeeds but does nothing is more dangerous than one that fails loudly — npm 12 makes that your default failure mode.

Treat this as a supply-chain project, not a version bump. Inventory the affected packages first. Then decide which ones get allow-listed back on.

Patch the trivial one first. On RabbitMQ 3.13.0+, an unauthenticated GET to /api/auth returns the OAuth client secret. With that secret, an attacker mints admin tokens and owns the broker. That means full control: read any queue, publish to any exchange, intercept your async layer. A second bug lets any authenticated user read queues and stats across virtual hosts with zero permissions. Queue names leak business logic. In k8s the management API is often reachable via service mesh. Treat as P0. Patch, then rotate any OAuth client secret configured during the vulnerable window.

The agent-tool half of the same problem

The attack surface moved from code bugs to trust relationships. AI tooling is the newest one. Ghostcommit embeds prompt injection in repo images. Cursor and Antigravity read the image, cat .env, and exfiltrate secrets byte-by-byte. PR review bots skip image analysis, so the malicious PR auto-approves. Claude Code with Opus refused. That is one model of several. Separately, @asyncapi/generator 3.3.1 and two sibling packages ship an import-time loader that fires on npm install in CI. Code execution with your pipeline's credentials.

The genuinely new defensive primitive

Tracebit's context bombs point LLM guardrails at the attacker. Transgressive prompts planted in Secrets Manager decoy values halt an attacking agent via its own safety training. Admin compromise fell from 57% to 5%. The defense gets stronger against more capable models. If you run canaries, retrofit these payloads. Allow-list your own SRE and review agents so they don't trip the trap.

Your AI coding agent reads .env like source. Assume it will. Put secrets outside its reach before an image PR proves the point.

The cost isn't writing skills. It's maintaining them. Anthropic's own engineers say Claude improves in spiky, non-uniform ways. A skill file tuned to one model's capability profile can perform worse on the next, over-constraining improved abilities and under-specifying regressions. So declarative skills behave like dependency management: compatibility matrices, staged rollouts, and automated testing of skill files against model versions before promotion.

The shift is real regardless

AIEWF 2026 made it concrete. DeepMind's Philipp Schmid demoed agents configured entirely in markdown. YC companies encode operational knowledge as skills files and hire engineers to maintain them. The most oversubscribed workshop was 'the dark arts of skills.md.' LangChain is now framed as legacy. AutoGPT went unmentioned. The consensus control pattern is inner/outer loop: an execution loop supervised by an evaluator loop. Structurally that is a Kubernetes reconciliation controller for agent behavior.

The inherited trade-off

The gain is readability and portability. The loss is the debugging hooks, conditional logic, and programmatic control of imperative Python. Matt Pocock's 'skills hell' warning covers hundreds of interacting skill files, and the fix is Terraform-module discipline or you drown. Confirmed failure mode: stale agents.md files with contradictory instructions act as self-inflicted prompt injection, stalling agents for hours on impossible constraints.

Treat skills.md as production config, not documentation. Its dependency graph breaks silently every time the model underneath it updates.

Safe posture: prototype declarative flows, but keep autonomous software-factory patterns off production-critical paths until the industry survives a full failure cycle.

If you serve long context and offload KV cache to CPU RAM, SparDA (NVIDIA/MIT) is this quarter's read. It adds a fourth 'Forecast' projection beside Q/K/V. That projection predicts which KV blocks the next layer needs, and prefetches them async on a separate CUDA stream, so the GPU never stalls on memory. Here's the craft: it runs per-GQA-group, which kills the softmax scoring loop. It trains post-hoc via KL divergence without touching the base model. It costs 0.41% parameter overhead. The 5.3x throughput is memory economics, not magic. Reliable prefetch keeps most cache on CPU, which frees HBM for larger batches. Caveat: if your p95 context fits in HBM, it's pure overhead.

The hidden cost you're not measuring

Claude's tokenizer charges 73% more than GPT for identical TypeScript. That's BPE vocabulary coverage, not quality. Anthropic's newer tokenizer regressed 30% versus its prior version. On code-heavy pipelines, per-token list price is the wrong number. Benchmark actual token counts across providers with your content.

The easy infra win

Graviton5 m9g is $0.78/hr against Intel at $0.85 and AMD at $0.97, all 4xlarge, all 64GB. Neoverse-V3 cores, DDR5-8800. That's a real memory-bandwidth generational jump, not a spec-sheet one. ARM compatibility is a non-issue for JVM/Go/Node/Python/Rust in 2026. Memory-bandwidth-sensitive services benefit most: caches, search indices, analytics.

Optimize where the money actually is: predictive KV prefetch for long context, tokenizer-aware routing for code, and ARM for anything memory-bound.