Przemysław Zalewski

JavaScript since 2012, browser and Node.js

A JavaScript developer who knows what the runtime does next

I modernize legacy JavaScript without taking the site down, make slow pages faster and prove it with numbers, and add a framework only where it pays for itself. Nine years of TypeScript, React and Node.js, in the browser and on the server.

Book a free 30‑min call Email me instead

Calls this week · work starts 3 November 2026 · Wrocław, Poland (CET), remote

Przemysław Zalewski
15+years shipping software
9years of TypeScript, React and Node.js
100,000+players of Korona Krulów, my open-source browser game
30,000concurrent users on my own chat app

Sound familiar?

JavaScript problems I fix in 2026

npm audit shows dozens of vulnerabilities. Where do we start?

On 31 March 2026 two hijacked Axios releases pulled in a malicious dependency that downloaded a remote access trojan. CISA’s alert of 20 April 2026 told teams to pin known safe versions, rotate npm tokens and CI secrets, and set ignore-scripts and a seven‑day min‑release‑age in .npmrc (CISA alert).

I upgrade dependencies in waves you can revert, each one checked by your tests. For a typical app, that often takes a single evening. You get a clean lockfile and a short list of what changed. In October 2025 a library pinned a vulnerable copy of nodemailer that no update could reach, so I forced the patched version with an npm override and had a clean audit the same day.

Legacy JavaScript nobody understands. Rewrite or refactor?

Handing it to an AI agent alone is a gamble. In the 2026 Stack Overflow Developer Survey, 48% of developers said they trust AI output when they can easily verify it (Stack Overflow 2026). Legacy code nobody understands is exactly the code you cannot easily verify.

I refactor behind tests: Playwright pins the flows that make money, the agent does the mechanical parts, and a person approves every merge. No big‑bang rewrite, and the site stays up. In September 2026 some Safari sessions kept losing an app’s local database; instead of the risky storage migration first proposed, I proved the real cause was a helper worker missing a 4‑second startup deadline, cached its files and added one retry, and the first production report confirmed it.

Sound like you? Book a free 30‑min call →

No documentation, and our AI agent keeps breaking the code

In a July 2026 test published by the Agentic AI Foundation, a twelve-line AGENTS.md, the file that tells coding agents how a project works, cut an agent’s run time by 27% and its diffs by 26% on an ambiguous task. Without it, two of five runs on a multi‑file task went off script, re-exploring the repo or running an unrequested production build (AAIF, 22 July 2026). Without written rules, new hires and agents both guess.

I write the architecture notes, runbooks and AGENTS.md from the code itself, then test them on a real task an agent has to finish. If the agent gets it wrong, the docs get fixed. In 2026 I gave the coding agents written rules, fixed documentation that had drifted from the code, and turned rules that kept being broken into automated checks.

Why is our website so slow on phones?

Only 48% of mobile sites passed Core Web Vitals in 2025, and median mobile Total Blocking Time rose 58% to 1,916 ms, nearly two seconds in which the page cannot respond to a tap (Web Almanac 2025).

I measure first with real‑user data in PostHog, then cut the usual three costs: request waterfalls, bundle weight and main-thread work. You see the before and after on the same chart. In 2023 a self-service sales demo had to feel fast on a live call; I traced it before touching anything, cut sub-requests, and it reached the prospect on schedule.

Facing one of these? Book a free 30‑min call →

Why me

No framework is also an option

A streaming HTML page with no client framework, a Workers API in plain modules. When React or Next.js would add cost without value, I say so. When they fit, see the React page.

Legacy that keeps working

jQuery, ES5, a bundler nobody dares to touch. I modernize in slices: tests around the risky parts first, then modules, then types. The site never goes dark. The target is usually TypeScript.

Performance you can measure

Fewer requests, streaming instead of polling, work off the main thread, images that arrive at the right size. Measured with real‑user data in PostHog, not with a Lighthouse score alone.

One language, both sides

Browser, Node.js, Cloudflare Workers, Electron, React Native. I fix the API and the UI in one pull request, so nothing waits on a hand‑off between teams.

Live demo

The event loop, visualized

Edit the snippet and run it in your browser. The timeline shows the real order: synchronous code, then microtasks, then macrotasks, with animation frames right before the next paint. Get it wrong and a spinner never stops, the UI flickers or a state update lands twice.

Demo loading…

Try nesting a setTimeout inside a Promise.then, or add an await in the middle. The timeline updates on every run.

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

Korona Krulów: a satirical React game for 100,000+ players

The problem
Spring 2020, lockdown, a joke that deserved a game before the joke got old.
What I did
React, 400+ actions, a leaderboard, open source on GitHub, built in my evenings.
Result
100,000+ players and ~700 upvotes on Wykop at launch.

100,000+ players 2 weeks open source Open ↗

Sources: Wykop: 698 upvotes · Antyradio · Wieści24 · Code on GitHub

See also: React · Games

Streaming agent output in one HTML request, no client framework

The problem
Agent output arrives out of order and takes a while. A page that waits for everything feels broken.
What I did
One HTML response streamed from the server, slots filled out of order as results arrive, no hydration, no client framework.
Result
First paint in milliseconds, the rest fills in live. The same idea runs the stream demo on the Next.js page.

streaming HTML no hydration

See also: Next.js

Fixes sent upstream instead of patched around

The problem
Bugs in the libraries we depended on: a CSS minifier crashing on missing border values, a queue package without an entry point, an image cropper broken on React 17, ads that could crash a mobile app, a design system package published without a file it needed.
What I did
I fixed the library bugs at the source and sent the pull requests upstream: cssnano and p‑queue in 2019, react‑image‑crop for React 17 in 2021, Sage’s Carbon design system in 2023. The Carbon fix came from outsourcing work for Sage. At Omio I fixed race conditions and made ads fail‑safe in the forks the product ran in production.
Result
Four fixes merged upstream, three of them into libraries with thousands of stars each, plus public fixes from client work. The full list with links is on the open source page.

3 merged upstream client work in public since 2019 Open ↗

Sources: cssnano #744 · p‑queue #69 · react‑image‑crop #417 · Carbon #5947

Facing something similar? Book a free call →

Press

Written up elsewhere

Real links, from Windows Phone apps in 2012 to a game in 2020. Online I go by Ciunkos. Some outlets are gone, so those links open an archived copy.

Antyradio“Fight the epidemic as the government and win the Korona Krulów. A satirical game with TVP news bars”“The work of one programmer, who built it literally at night.” Antyradio’s review of the game.Read the archived copy (in Polish) Gazeta Plus“The game »Korona Krulów«. Lead the PiS government and make decisions in a time of plague…”News piece on the game, the day after launch.Read the archived copy (in Polish) Wieści24“…A game about the coronavirus in Poland has appeared online: Korona Krulów”News coverage of the game the day after launch.Read (in Polish) Wykop“Feel like the Chairman and run the country in Korona Krulów: the game is out”Korona Krulów launch day: 698 upvotes and 152 comments.Read (in Polish)

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week JavaScript code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

Review as a craft

800+ pull requests reviewed on one product since 2018. I review for the product and its reasons. The code comes second.

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Agents under rules

Claude Code and Codex work on main with hooks, lint and test gates. The model suggests, the criteria decide. Every PR gets a human review and AI‑assisted content is disclosed.

Good to know

JavaScript facts that changed in 2025 and 2026

Node.js 20 is end of life

Node 20 reached end of life on 30 April 2026. Node 22 follows on 30 April 2027, and Node 26 becomes Active LTS on 28 October 2026 (Node.js release schedule).

One Node.js major a year from 27

Starting with Node 27 there is one major release a year and every release becomes LTS. The odd and even split is gone (Node.js blog).

npm classic tokens are revoked

npm revoked every classic token in December 2025. Write tokens now last at most 90 days, so old CI publish pipelines fail until moved to granular tokens or trusted publishing (GitHub changelog).

require() of ESM works, with one catch

Node 20.19, 22.12 and 23 load ES modules through require() without a flag, but a module graph with top‑level await throws ERR_REQUIRE_ASYNC_MODULE (Node.js modules docs).

Temporal is not Baseline yet

The Date replacement ships in Chrome, but MDN marks it limited availability, so production code still needs a polyfill (MDN).

jQuery 4 drops old browsers and helpers

jQuery 4.0 dropped IE 10 and older and removed helpers such as jQuery.isArray and jQuery.parseJSON. A blind version bump breaks old plugins (jQuery blog).

FAQ

Questions people ask before they book

JavaScript or TypeScript?
TypeScript for anything that lives longer than a weekend, plain JavaScript where a build step would cost more than it saves: small sites, scripts, Workers, demos like the one on this page. Both are on my daily stack, see the TypeScript and Node.js page.
Can you modernize an old jQuery or ES5 codebase?
Yes, in slices and without a big‑bang rewrite. First a Playwright suite around the flows that make money, then modules, then types, then whatever framework the product needs. The site keeps running throughout.
What does it cost?
Start with the one‑week codebase audit above: a fixed price range, with the final number in writing within 24 hours of the call. Larger work is billed by the hour or as a fixed monthly B2B contract, both listed on the pricing page. The configurator shows a range for your project right away.
Node.js on the server?
Yes: Express APIs, streaming endpoints, workers and queues, Postgres. Hardening flags on, dependencies reviewed, same‑day response to advisories. Details on the TypeScript and Node.js page and the Cloudflare page.
Can you make a slow page faster?
Yes. I measure on real‑user data and you see the before and after on the same chart. The three usual costs are listed in the problems above. The Next.js page has a live demo of the waterfall problem.
How soon can you start?
From 3 November 2026. Book the call and bring the repo, or a link to the page that feels slow.
You are one person. What if it fails or you get sick?
Start small: the one‑week audit or one reviewed pull request, both priced before we start. Hourly work has no minimum, so you can stop at any time and keep everything delivered. Code, CI and docs live in your repository from the first commit, the contract transfers the copyright to you in writing, and every project keeps a runbook and architecture notes. If I am ill, you hear it the same day. How I work.
Which Node.js version should we run in production in 2026?
Node 24 or 26. Node 20 is already end of life and 22 ends in April 2027 (Node.js release schedule). The node --permission flag is not a sandbox for untrusted code, so do not count on it (Node.js docs).
Why did our npm publish from CI stop working?
Classic tokens were revoked in December 2025, and write tokens now expire within 90 days (GitHub changelog). Move CI to trusted publishing or a granular token with a renewal reminder.
npm audit shows dozens of vulnerabilities. Where do we start?
On 31 March 2026 two hijacked Axios releases pulled in a malicious dependency that downloaded a remote access trojan. CISA’s alert of 20 April 2026 told teams to pin known safe versions, rotate npm tokens and CI secrets, and set ignore-scripts and a seven‑day min‑release‑age in .npmrc (CISA alert). I upgrade dependencies in waves you can revert, each one checked by your tests. For a typical app, that often takes a single evening. You get a clean lockfile and a short list of what changed. In October 2025 a library pinned a vulnerable copy of nodemailer that no update could reach, so I forced the patched version with an npm override and had a clean audit the same day.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

Why did the JavaScript developer quit?Punchline

He didn’t get arrays. Ba‑dum‑tss.

Why did the JavaScript developer’s partner leave?Punchline

Too many promises. None of them resolved. Ba‑dum‑tss.

Why was the JavaScript developer sad?Punchline

He didn’t Node how to Express himself. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

TypeScript & Node.jsTyped APIs, Postgres at scale, tests that encode security.Live demo ReactInterfaces, tests and the dashboard that proves they work.Live demo Next.jsApp Router done right, or an honest exit plan.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack