Data files are not passive. They can manipulate and compromise your application.

We are used to thinking about code as having the capacity to behave maliciously. Stories about services being compromised, supply chain attacks and bugs leaking data are fairly common.

By comparison, transmission formats like JSON and XML are typically regarded to be fairly inert. In fact, these too can be a credible threat to your application.

Not all 'Open' initiatives are equal

In the Open Data community I have noticed an occasional blurring of two very different concepts; Open Data and Open Access (in the sense of 'freely available documents'). This can cause problems and increase costs for all stakeholders involved (from data availability to FOI burden).

I argue here that we (managers, data scientists, developers) need to strongly differentiate the two, as it has a real impact on the community stakeholders - the individuals, businesses and institutions that consume our data.

In this article I'll set out a case (from a consumer perspective) for each, to provide some insight into how these are two different things for two very different audiences.

There have been several high-profile supply chain attacks in the NPM ecosystem recently, including the tanstack compromise a few days ago, the recent Axios 'RAT' of Spring 2026, the first wave of "Shai-Hulud" worm in late 2025 and before that chalk and debug in September 2025 - and many more in between all these.

If you run a web application or Node.js service, this should be a concern. Every time you run npm install you may be pulling a compromised version of a package - if that happens your local data is at risk, so are the stored keys you use to access services, depending on the malicious code you may even spread the infection.

A reflection on a day's work with AI coding assistance

AI code assistance is all the rage in software development. I decided to spend a day working with IntelliJ's Junie AI in "chat mode", to build a clean sheet project, to analyze the sort of technical decisions that the AI made, where it went wrong and what it struggled with.

The world’s data is siloed, and connecting to it is a chore

Whether it’s accessibility information, satellite imagery, live sports results, or transport updates, the data we need is usually buried behind inconsistent APIs, rate limits, and custom auth layers.

For publishers, distributing data at scale is an infrastructure nightmare. As subscribers, we're stuck in endless cycle of writing connectors for each new data source, keeping up with API changes, tweaking polling logic and so on.

We’re building Hypermass - an open platform to make data flow, without the headaches.