惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

N
News and Events Feed by Topic
Malwarebytes
Malwarebytes
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
C
Cybersecurity and Infrastructure Security Agency CISA
F
Future of Privacy Forum
C
Cisco Blogs
T
The Exploit Database - CXSecurity.com
A
Arctic Wolf
S
Securelist
K
Kaspersky official blog
S
Schneier on Security
T
ThreatConnect
T
Tenable Blog
Spread Privacy
Spread Privacy
T
True Tiger Recordings
AWS News Blog
AWS News Blog
F
Fox-IT International blog
量子位
T
Threatpost
V
Vulnerabilities – Threatpost
C
CERT Recently Published Vulnerability Notes
Cisco Talos Blog
Cisco Talos Blog
GbyAI
GbyAI
宝玉的分享
宝玉的分享
腾讯CDC
G
Google Developers Blog
aimingoo的专栏
aimingoo的专栏
Cyberwarzone
Cyberwarzone
有赞技术团队
有赞技术团队
S
SegmentFault 最新的问题
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
V
Visual Studio Blog
U
Unit 42
雷峰网
雷峰网
cs.CV updates on arXiv.org
cs.CV updates on arXiv.org
Simon Willison's Weblog
Simon Willison's Weblog
O
OpenAI News
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
The GitHub Blog
The GitHub Blog
The Register - Security
The Register - Security
MyScale Blog
MyScale Blog
小众软件
小众软件
A
About on SuperTechFans
Last Week in AI
Last Week in AI
Y
Y Combinator Blog
博客园 - 三生石上(FineUI控件)
美团技术团队
Google Online Security Blog
Google Online Security Blog
P
Proofpoint News Feed
MongoDB | Blog
MongoDB | Blog

DEV Community

What I’m Starting to Look for in Engineers Vitreus: Local-First Spreadsheet Intelligence with Gemma 4 Transfer Fees, Metadata, and Soulbound Tokens: A Tour of Solana Token Extensions I got tired of re-explaining my codebase to ChatGPT — so I built a VS Code extension Revisiting My Phone AI After Gemma 4: The Upgrade I Didn't Know I Needed I built a privacy-first PDF merger in 7 hours — here's the stack and the lessons Google I/O 2026 made me ask an uncomfortable question: are we still coding, or are we managing builders? SSR with JavaScript: Escaping Node.js Clunkiness with AxonASP My CKA Exam-Day Experience: What Went Right, What Went Wrong, and Lessons Learned Gemma 4 Soft Tokens: The Rise and Fall of 16x16 Words ⚡👀 Two weeks ago, I built a private AI brain on my phone using Gemma 4. Yesterday, Google dropped a new variant that made everything I built feel like a beta test. 256M parameters. MoE architecture. Apache 2.0 license. I broke down what changed and why it mat I got tired of clicking through the Stripe dashboard, so I built a CLI Getting Data from Multiple Sources in Power BI: A Practical Guide to Modern Data Integration Google Is No Longer Just a Search Engine I built GemmaPod - A truly composable and portable AI agent solution powered by your local LLM Gemma 4 E4B caught three planted fabrications in 50 seconds — on a laptop, no cloud How to build an AI-powered content moderation pipeline for user comments Running Gemma 4 on a Modest Machine: Unsloth vs LM Studio vs llama.cpp vs Ollama AI Makes Building Cheap. Our Product Architectures Still Assume It’s Expensive. I built an in-browser Roku TV remote with ~80 lines of TypeScript. Here's how Roku's ECP API actually works The Direction of Blame babbled notes: a sound-to-music agent for people who could not make music before How I Built a Live SQL Workshop Where Students Can't Break Anything Rescuing a Stranded Protocol: Re-Skinning Legacy Code for the Trestle DeFi Flywheel SOLID Heuristics Reveal Incomplete Domain Knowledge — Nothing More AllasCode Intitute / FullAgenticStack: The Intent-Based Router Introducing LogicGrid — Multi-Agent AI Orchestration for .NET AI Prompt Injection, Drupal SQLi Exploitation, and Nmap for Hardening AI Agents & Python Workflows: Anthropic Skills, Jupyter Challenges, and Edge Deployment SQLite Optimization, PostgreSQL Async Queries, & DuckLake Dataframe Spec RTX 5080 Undervolt Benchmarks, CGO-Free CUDA API Binding, & AMD GPU Compatibility Fix Microsoft Burned Its 2026 AI Budget on Claude Code in Six Months. That's the Real Story. Why I Started Learning FastAPI in 2026 I Abandoned Ghost for Months — Then Came Back and Finally Finished It Building an Open MIT-Licensed Ephemeris Engine in C — JPL Moshier Ephemeris 4 Smart Ways to Manage Retries in Side Projects Securing Web APIs: A Practical Guide to Authentication & Authorization Methods Google I/O 2026: AI Built an OS in 12 Hours. I Spent Mine Sorting Screenshots. 🤦 Half a Day, Not a Week: One Nix Flake for Three Machines 🌱 Keep Feeding Your CI/CD — Or Watch It Die Gemma 4 vs GPT-4o vs Llama 3: What Actually Works Locally? Vessel Ops SSH in 2026: Why Every Developer Should Know It Cold Audit AI-Generated PRs Before You Merge Them (Swarm Orchestrator 10.3.0) App Store Optimization (ASO) I built a tool to visualize Django REST Framework architecture (URLs, Serializers, Models, and more) How I made my React site agent-ready in 100 lines AI Can Generate Interfaces on the Fly. But Users Still Need Orientation. AI-Assisted Content Workflow How We Learned That Most Resume Rejections Happen Before Humans See Your CV How I Prepared for CKA: Resources, Labs, and Strategy That Worked for Me Remix Mini PC: Moving the Whole Operating System Onto the eMMC Stop Flying Blind: We Built an LLM Evaluation Framework That Works Across 17+ Agent Frameworks The Misleading "User is not authorized to access connection" Error in AWS CodeBuild — and Why Your IAM Policy Looks Fine I Resurrected a Dead F1 Project and Accidentally Built a Race Intelligence OS Remix Mini PC: After a Year of Dead Ends, the eMMC Finally Talks Not All Games Are Equal: The Real Difference Between a Trap and a Tool How to add Peppol e-invoicing to your SaaS without making it your team's problem I Built a Hermes Agent to Tell Me Which Hackathons to Enter. It Told Me to Enter This One. The Five Hooks That Change How You Ship With Claude Code Powering Your Progress: Building Robust Solutions with Laravel I built a self-hosted CI/CD platform with persistent queue, encrypted secrets, and rollback UI — here's what I learned Antigravity 2.0 and the $1,000 OS: Why "Agent-First" Feels Like the Direction I've Been Building Toward Anyway I built an AI PR-triage agent in 30 lines of Markdown Core Web Vitals from 74 to 91: A Real Tax Practitioner Site Rebuild I Gave Gemma 4 150 Tools on Windows. Here's What Actually Happened. Beyond the Loop: Why Monolithic AI Agents Fail and How to Build a Microkernel Architecture The Hidden Tax of AI-Assisted Development (And How I Fixed It) I Ditched Cloud LLMs for Gemma 4 4B: A DevOps Engineer's 48-Hour Reality Check Building a Schema.org @graph That Validates on the First Try The "Lift and Shift" Trap: Why Your Integration Layer Needs More Than Just a Cloud Address All 7 OSI Layers Explained with Real-World Analogies Antigravity 2.0 in one day: the four shells and what each is good for Self-Hosting Google Fonts with size-adjust: Zero CLS Web Font Swap The Multi-Provider LLM Problem: Why “One API” Is Not Enough How I indexed 69,000 Claude Code skills (and what I learned doing it) RememberMe CareGrid: Local Gemma 4 for dementia memory and safety Google Is Killing Gemini CLI on June 18. Here Is What to Do Before Then Do Domínio ao Deploy: Hospedando Arquivos de Deep Links no Cloudflare Pages (Parte 7.1) Running Gemma 4 26B on an Old GTX 1080 with llama.cpp Devlog 1: I tried building an SNES game with the super FX chip Why Gemma 4 Feels Like an Important Moment for AI Developers✨ From Zero and Confused, This Is How I Started Learning to Code I Built a Local AI Gateway That Talks to Claude, ChatGPT, DeepSeek and Gemini — Without a Single API Key Bootstrapping with AI: Why Gemma 4 is the Micro-SaaS Founder’s Best Friend MyErp Architecture Series - #02 Cellular Architecture: Mapping Biology to Software Systems NodeJS vs Bun vs Go 🌍 RTL Arabic Style UI How Does an AI Agent Actually Buy Something? Google Just Published the Spec. Google I/O 2026 Is One Uncanny F.R.I.E.N.D.S Group Upgrade I Replaced 70MB Node.js Log Viewer with a 172KB Zig Binary The "MTTR Is All You Need" Trap The Quiet Revolution: How Firebase Became the First Agent-Native Backend at Google I/O 2026 I Built ResuMate! A 100% Private, Local AI Resume Optimizer with Google Gemma 4 Learning DirectX 12 - Part 2 Initialization Theory NeuralHats: I Put Edward de Bono’s Six Thinking Hats on Local LLMs Using Gemma 4 📝 Instant Auto Save Notes Engineering the "App-Like" Experience: A Deep Dive into PWA Architecture I built a local first AI CCTV assistant using Gemma 4 + Frigate CrowdShield AI — Smart Stadium Operating System & Crowd Intelligence Platform
An npm Downloads Comparison Chart in 300 Lines of Vanilla JS — Nice-Tick Math and API-Direct Fetch
SEN LLC · 2026-05-25 · via DEV Community

SEN LLC

"react vs vue vs svelte vs solid-js — who's actually winning?" This tool answers it. Fetches daily downloads from api.npmjs.org (CORS-enabled, no auth) and overlays up to 6 packages on one inline SVG chart. No chart library. ~300 lines of vanilla JS. The scale + tick math is pure and gets 17 unit tests.

🌐 Demo: https://sen.ltd/portfolio/npm-downloads-chart/
📦 GitHub: https://github.com/sen-ltd/npm-downloads-chart

Screenshot

Why DIY?

I wanted:

  • Pick arbitrary packages, compare side-by-side
  • Switch the time range instantly
  • No D3, no Chart.js, no Recharts — write the SVG by hand
  • Practise direct API consumption from the browser

That whole brief fits in 3 files, ~300 lines. As a bonus, writing it makes you understand what Chart.js is actually doing internally.

The npm API

The public endpoint takes no auth:

https://api.npmjs.org/downloads/range/<period>/<package>

Enter fullscreen mode Exit fullscreen mode

<period> is last-week, last-month, last-year, or YYYY-MM-DD:YYYY-MM-DD. Response shape:

{
  "downloads": [
    { "downloads": 8523912, "day": "2025-05-24" },
    { "downloads": 9213489, "day": "2025-05-25" }
  ],
  "package": "react",
  "start": "2025-05-24",
  "end": "2026-05-23"
}

Enter fullscreen mode Exit fullscreen mode

CORS is enabled, so the browser can fetch it directly — no proxy server.

const BASE = "https://api.npmjs.org/downloads/range";

export async function fetchDownloads(packageName, period = "last-month") {
  const url = `${BASE}/${encodeURIComponent(period)}/${encodeURIComponent(packageName)}`;
  const res = await fetch(url);
  if (!res.ok) {
    if (res.status === 404) throw new Error(`package not found: ${packageName}`);
    throw new Error(`npm API ${res.status}: ${packageName}`);
  }
  const json = await res.json();
  return {
    name: packageName,
    points: json.downloads,
    start: json.start,
    end: json.end,
  };
}

Enter fullscreen mode Exit fullscreen mode

Fan-out with Promise.allSettled so one bad package name doesn't kill the chart:

export async function fetchMany(packageNames, period = "last-month") {
  const results = await Promise.allSettled(
    packageNames.map((n) => fetchDownloads(n, period))
  );
  return results.map((r, i) =>
    r.status === "fulfilled"
      ? { ok: true, series: r.value }
      : { ok: false, name: packageNames[i], error: r.reason.message }
  );
}

Enter fullscreen mode Exit fullscreen mode

The failed packages get listed in the UI's status line; the chart renders whatever succeeded.

Nice ticks (the algorithm Chart.js / D3 also use)

If your max is 8723, you don't want a y-axis labelled 0, 1500, 3000, 4500, 6000, 7500, 8723. You want 0, 2000, 4000, 6000, 8000, 10000. The trick is to snap the step to the nearest "round" fraction times a power of 10:

export function niceTicks(min, max, targetCount = 5) {
  const range = max - min;
  const roughStep = range / targetCount;
  // What order of magnitude is this step?
  const exponent = Math.floor(Math.log10(roughStep));
  const fraction = roughStep / Math.pow(10, exponent);
  // Snap fraction to {1, 2, 2.5, 5, 10}
  let nice;
  if (fraction <= 1) nice = 1;
  else if (fraction <= 2) nice = 2;
  else if (fraction <= 2.5) nice = 2.5;
  else if (fraction <= 5) nice = 5;
  else nice = 10;
  const step = nice * Math.pow(10, exponent);
  const ticks = [];
  const start = Math.floor(min / step) * step;
  const end = Math.ceil(max / step) * step;
  for (let v = start; v <= end + step / 2; v += step) {
    ticks.push(Math.round(v / step) * step);
  }
  return ticks;
}

Enter fullscreen mode Exit fullscreen mode

The five steps:

  1. Order of magnitude via Math.log10() — for 8723, exponent is 3 (10³ = 1000).
  2. Target step divided by that magnitude — 8723/5 = 1744.6, divide by 1000 = 1.7.
  3. Snap to nearest in {1, 2, 2.5, 5} — 1.7 → 2.
  4. Scale back up — 2 × 1000 = 2000.
  5. Tick from 0 by step[0, 2000, 4000, 6000, 8000, 10000].

That gives you:

  • niceTicks(0, 47, 5)[0, 10, 20, 30, 40, 50]
  • niceTicks(0, 8723, 5)[0, 2000, 4000, 6000, 8000, 10000]
  • niceTicks(0, 12345, 6)[0, 2500, 5000, 7500, 10000, 12500]

Same algorithm used by Chart.js / D3 / Recharts under the hood, condensed to ~20 lines.

Compact count formatting

12500000 is unreadable on an axis label. 12.5M is fine.

export function formatCount(n) {
  if (n < 1000) return String(n);
  if (n < 1_000_000) {
    const v = n / 1000;
    return v >= 100 ? `${Math.round(v)}k` : `${v.toFixed(1)}k`;
  }
  const v = n / 1_000_000;
  return v >= 100 ? `${Math.round(v)}M` : `${v.toFixed(1)}M`;
}

Enter fullscreen mode Exit fullscreen mode

The rule: drop a digit of precision per decade. 999 stays as-is. 12341.2k. 123456123k (the leading digit makes a decimal redundant). 234567890235M. Reads cleanly on a chart axis without 0.000 clutter or 1234567 walls.

SVG line rendering

The packages span a wide range — react is 22M/day at peak, solid-js is around 200k/day. You could give each series its own y-axis, but for a comparison chart the size difference is the message. So they share one scale; svelte and solid-js show up as flat lines near the bottom, react soars above. That's the truth being conveyed.

const xScale = linearScale(0, dayCount - 1, 0, innerW);
const yScale = linearScale(0, yMax, innerH, 0); // inverted: SVG y grows down

const seriesLines = seriesList.map((series, i) => {
  const color = COLORS[i % COLORS.length];
  const coords = series.points.map((p, idx) => ({
    x: xScale.apply(idx),
    y: yScale.apply(p.downloads),
  }));
  return `<polyline fill="none" stroke="${color}" stroke-width="2"
    points="${polylinePoints(coords)}" />`;
}).join("");

Enter fullscreen mode Exit fullscreen mode

A single <polyline> with points="x1,y1 x2,y2 ..." is enough. You could go Bézier-smoothed with <path d="M ... C ..."> but daily downloads have meaningful weekly seasonality (lower on weekends); smoothing would lie about that.

Architecture

scale.js     ← Pure functions: linearScale, niceTicks, formatCount … (17 tests)
chart.js     ← SVG renderer (depends only on scale.js)
npm-api.js   ← api.npmjs.org client (direct CORS fetch)
app.js       ← UI glue: input → fetch → render

Enter fullscreen mode Exit fullscreen mode

Dependency direction:

app.js → npm-api.js (fetch)
app.js → chart.js → scale.js

Enter fullscreen mode Exit fullscreen mode

scale.js doesn't touch the DOM or fetch. Functions like linearScale(0, 100, 0, 500).apply(50) === 250 are unit-testable in Node:

test("niceTicks rounds awkward maxima to clean numbers", () => {
  const ticks = niceTicks(0, 8723, 5);
  assert.equal(ticks[0], 0);
  assert.ok(ticks[ticks.length - 1] >= 8723);
  // step must be one of {1, 2, 2.5, 5} × 10^k
  const step = ticks[1] - ticks[0];
  const exponent = Math.floor(Math.log10(step));
  const frac = step / Math.pow(10, exponent);
  assert.ok([1, 2, 2.5, 5].some((n) => Math.abs(frac - n) < 1e-9));
});

test("w-screen vs h-screen separation", () => {
  // not from this project but the same principle: separate tests from rendering
});

Enter fullscreen mode Exit fullscreen mode

Splitting the project this way means I caught two real bugs before any pixel rendered: the max === min edge case (degenerate scale) and the float-drift accumulator inside the tick generator. Both are off-by-one-y-axis-tick types of bug that are hard to spot visually but trivial to assert in Node.

Try it

Paste some package names you actually use. Compare your stack against the alternatives. The chart isn't going to flatter anyone — it just shows the numbers.

Takeaways

  • npm's public download API takes no auth and has CORS enabled — browsers can fetch it directly.
  • Promise.allSettled is the right primitive for multi-package fan-out: one 404 doesn't kill the chart.
  • The {1, 2, 2.5, 5} × 10^k snap is the classic nice-tick algorithm that Chart.js / D3 / Recharts all use internally — ~20 lines reimplements it.
  • Compact formatting is "drop a digit of precision per decade" (1.2k123k1.2M235M).
  • Pure scale math separated from SVG rendering means node --test can verify the boundary cases (degenerate domains, float drift, off-by-one) that are nearly impossible to spot visually.

This is OSS portfolio #242 from SEN LLC (Tokyo). We ship small, sharp tools continuously: https://sen.ltd/portfolio/