Unfortunately, we're once again on campaign to mitigate supply chain attacks. You're not immune to them, so stay aware and follow the tips in this guide to protect your projects.

Andrey Sitnik@en.sitnik.es · yesterday

Popular npm packages keyv and cacheable were hijacked, and malicious versions containing a malware were released to steal users’ access tokens. Protect your packages from the same fate with my guide, based on maintaining PostCSS and 100+ other projects: evilmartians.com/chronicles/t...

Did we tell you that we're hosting a Ruby conference in SF later this year? The second edition of @sfruby.com is happening Nov 10–12 at SFJAZZ, and honestly, we can't wait. 450 Ruby devs will meet to learn where the ecosystem stands today and discuss its future. 🧵

Come with your team to the conference and get time on stage to present your company and any job openings. Those who buy tickets before September 30 get matched with potential candidates ahead of the event.

San Francisco Ruby Conference, Nov 10-12, 2026@sfruby.com · 5d ago

Conferences are perfect for finding candidates and see how they talk, think, and share ideas in a low-stress environment. That's why every company that brings 5+ people to the conference gets: - Matched with devs looking for a job before the event - Time on stage to share vacancies Tickets below.

This conference or the SF Ruby community wouldn't exist without @inazarova.bsky.social.  She's the co-founder of @anycable.io, CEO at @evilmartians.com, Murka's 🐈 subordinate, and a Ruby/OSS lover. Her passion is to support and champion startups on Rails. Catch her keynote at the conference!

As a Ruby on Rails engineer, @marcoroth.dev is a key player in the community. He's pushing the boundaries of real-time, server-rendered apps with HTML-over-the-wire. That focus on HTML-heavy Rails views led him to create Herb. Come see him at the conference!

Supply chain attacks stealing npm packages are a real threat, with new attacks monthly. But an npm package doesn’t need to be famous to become a target. Check this new post from @en.sitnik.es on the secure release setup made from our experience with 100+ open-source projects. Agent skill inside.

The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

evilmartians.com

My new article is out! A systematic guide to releasing npm packages as safely as possible in 2026 (with a Skill to quickly apply the practices to your open source projects). Not just “do X”: I cover real supply chain attacks and explain how each defense helps. evilmartians.com/chronicles/t...

The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

evilmartians.com

AI-assisted coding helps lean teams code and validate ideas quickly. But as adoption grows, it's time to give the UI/UX a facelift and set guardrails for the future. See how @objartel.bsky.social audited this UI and built a design system for devs and agents to use:

Building a design system specced for engineers and agents—Martian Chronicles, Evil Martians’ team blog

Coding without design guidelines can leave teams with an inconsistent UI design and a complex feature development process. Here's how we built a design system for Currents that's readable by engineers and AI agents.

shorturl.at

Welcome Carmine Paolino (@paolino.me) as one of our speakers.  He's an AI engineer, founder, and open source contributor. He created RubyLLM, bringing modern AI tooling to Ruby, and co-founded Freshflow and Chat with Work. Catch him on stage: https://luma.com/sfrubyconf2026

A massive thanks to everyone who bought early bird tickets for the 2026 SF Ruby Startup Conference. We sold out this tier! General and support tickets for the conference are available: https://luma.com/sfrubyconf2026

Don't zoom in on the martian!

It's time to welcome Chris Oliver (@excid3.com) as one of our amazing speakers! Chris is a Rails Luminary, founder of GoRails, and host of  Remote Ruby podcast.  We're very happy to have him on stage this year. Catch his talk at the conference.

The @evilmartians.com blog now includes skills for AI agents. Say you liked the advice in one of our articles and want to apply it to your project. Now you can install the skill from the article and let your AI agent put it into practice. evilmartians.com/agent-skills

We recently found that @clerk.com, @firebase.com, and Better Auth are using Nano Stores! Nano Stores is our tiny atomic state manager for React, Vue, Svelte, and vanilla JS. This got us excited and led us to dig deeper. We found this tool built by @en.sitnik.es how was ~5M npm downloads/month.

Entering the speaker lounge: Jason Bosco (@jasonbosco.bsky.social)  He's the founder of Typesense, a bootstrapped, open-source search engine built on Rails. It handles 10+ billion searches every month. We're excited to have him on stage.

Meet Cole Robertson (@colerobertson.dev).  He's the co-founder and CTO at Rebulk (YC S25), an AI-powered logistics startup built with Rails and Inertia. He'll share how he's building it at the conference. Get tickets and catch his presentation: https://luma.com/sfrubyconf2026

We told you, so of course we did it too: we measured two months of server-side LLM traffic to our website. Find out which agents read HTML, which read Markdown, what llms.txt actually does, and the technique that got zero hits:

Which AI actually reads your site? Two months of LLM traffic, measured—Martian Chronicles, Evil Martians’ team blog

We told you to measure. So of course we did it ourselves too: two months of server-side LLM traffic to evilmartians.com. Find out which agents read HTML, which read Markdown, what llms.txt actually do...

evilmartians.com

Your coding agent can now install skills with our engineering best practices. Inside: - llms-visibility to make your site discoverable by Claude, ChatGPT, Perplexity. - storybook-workbench to audit your React and Vite UI - layered-rails to write, refactor, and review Rails code All here:

Agent skills by Evil Martians

Real engineering practice, packaged as skills your AI coding agent can install. Add one to Claude Code, Cursor, Codex, GitHub Copilot, or Gemini CLI, and it builds the way we do: the techniques we rel...

evilmartians.com

Only 4 tickets left in the early bird sale! Share this with your Ruby friends and invite them to come. Let's sell out!  https://luma.com/sfrubyconf2026

A huge THANK YOU to everyone who's already bought tickets to the SF Ruby Conference. 🫶 Every notification from Luma puts a smile on our faces. See you in a few months!

We're building the SF Ruby Conference around human connection. We'll have organized networking sessions to give Ruby engineers the chance to: - Learn from the best speakers - Get to know them in small groups - Find users for their OSS - Land a new job Less than 15 early bird tickets left:

San Francisco Ruby Startup Conference · Luma

This is a 3-day pass. Access all talks and networking sessions from Nov 10-12. Ruby is where startups grow. The companies that scaled on Ruby and Rails are the…

luma.com

Speaking at the SF Ruby Startup Conference: Rosa Gutiérrez (@rosa.codes)! You may know her from her work at 37signals or as the creator of Solid Queue. She loves puzzles, theoretical CS, and her pup: Mochi. Get early bird tickets for the conf and see her on stage: luma.com/sfrubyconf2026

Inertia.js isn't a framework but it still seems like magic: the base is a 50-line client inspired by Turbolinks, and the rest is Rails. @skryukov.dev rebuilds it from scratch, one commit at a time. Read once and see exactly what you're betting your frontend on: evilmartians.com/chronicles/t...

The joy of Inertia Rails: painting your own with 50 happy little lines—Martian Chronicles, Evil Martians’ team blog

Inertia is Turbolinks with one twist: render JSON instead of HTML on the second visit. We rebuild the whole protocol on a real Rails app with a 50-line client and a 16-line server, then audit what the...

evilmartians.com

We're looking for Ruby/Rails startup success stories. We want you to speak at the SF Ruby Startup Conference if you've: - Achieved outstanding results with a small team - Built tooling to help others reach the same results - Used AI for scaling Submit a talk proposal before July 27. Link below.

We use @devongovett.me's tools across our projects. We particularly rely on React Aria to make our tools accessible. As part of our open source donation program, we donated to Devon to thank him for his work and impact on the community. He's also the creator of Parcel and Lightning CSS.

Evil Martians@evilmartians.com · 2mo ago

We just donated to @heyapi.dev as part of our open source donation program! It's a TypeScript toolkit that turns your OpenAPI spec into a fully typed API for frontend and backend. We use it so much that one of our engineers, Yuri Mikhin, even built the NestJS plugin for it.

Nano ID 6.0 is out. We made it 4x faster, and our JS implementation now beats the native C++ crypto.randomUUID(). github.com/ai/nanoid Orhan Aydoğdu came up with the trick for nope-id and let us port it to Nano ID. github.com/ai/nanoid/pu... How it works ↓

An agent can spin up a web app in an afternoon. But which of those 469 component files actually matter, and which are dead ends abandoned three prompts ago? That's why we built Storybook Workbench: a set of agent skills that audit your AI-generated UI and lay it out in Storybook.

The 2026 SF Ruby Startup Conference is now a reality.  We have confirmed: - 40+ attendees, coming from our community-only early bird sale - 10 speakers, including Garry Tan, CEO and president at Y Combinator - 2 sponsors You can get early bird tickets on July 15th for only $350.

AI vs. humans for design? We figured this out the hard way after burning money and our team’s time on blog illustrations. Here's what we learned. 🧵

We launched our private SF Ruby Conference early bird sale 5 hours ago. Half the tickets are already gone! Grab a supporter/corporate ticket now, or wait for the public early bird access on July 15. The ticket is valid for the three days and gives you access to structured networking sessions.

San Francisco Ruby Startup Conference · Luma

This is a 3-day pass. Access all talks and networking sessions from Nov 10-12. Ruby is where startups grow. The companies that scaled on Ruby and Rails are the…

luma.com