i'm sorry npm, but you need to fix this. it has been more than 3 months now. users need to be able to read deprecation warnings.

Once upon a time, the internet was a village where people built things for each other. It's exciting seeing folks explore developer-centered spaces like tangled.org 🍿

Typosquat attacks uncovered yesterday on payment services: Paysafe, Skrill, and Neteller. Check your dependencies! Pin the compromised versions, stay safe. socket.dev/blog/npm-pyp...

Have you ever tried to POST with a GET? 😜 Or query with a POST? We're just glad the new HTTP Query method is here

Porffor is now self-hosted, meaning it compiles itself with itself! This is made possible by Porffor's new rewrite, reducing its lines of code by >50% and making C output up to 5x more efficient! Here you can see the stats before and after the rewrite for Porffor itself:

🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs

npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...

pnpm 11.10 adds a new _auth setting that ties each registry credential to its host, so a malicious or compromised repo file can't redirect your token to a different server. The release also hardens pnpm deploy, pack-app, and more. socket.dev/blog/pnpm-11...

OMG, @jddalton.bsky.social has a wild proposal for Rspack's native binding: - size: 38.4 MiB -> 13.8 MiB (-64%) - first load: 853ms -> 615ms (-28%)

Landed a few improvements to the error reporting for require(esm) with top-level await (behind --experimental-print-required-tla for now): - No longer need to run the code to collect the TLA locations, so it can be enabled by default soon - Added require stack and location metadata to the error

Right now, if you import something from JS, and the result is a 404 (or other not-ok status code), it fails the load & gives you nothing. I wonder with json imports, and maybe even text/byte imports, if that's the right pattern github.com/whatwg/html/...

npmx 0.16 rainbow comet is out! 🌈💫

13 years ago today I made the first commit to the ESLint Git repo. It’s hard to believe that this project I cobbled together in my spare time over a couple of weeks is still going strong. I’ve been doing a lot of reflecting over these years and the journey it’s been. A thread.

here's an @e18e.dev tool to summarise and visualise v8 deoptimisations. with `npx @e18e/deopt your_script.js`, you basically get a UI served up locally which shows where v8 deoptimised your code. you can also use `npx @e18e/deopt --md your_script.js` to get a markdown summary

📢 We released Babel 8 last week! Babel now targets modern browsers by default, is now ESM-only, and ships TypeScript types for all of its packages. We waited a week before announcing it to catch any last minute regressions, but now it's time for you to update your Babel version 😄

Very early sneak peek to pnpr - the pnpm registry: pnpm.io/pnpr/

Could npm be rebuilt on atproto? www.jasnell.me/posts/what-i...

continuing to share stupid bullshit i had nano banana make for my slide deck

tf is a zizmor anyway. nobody asks these questions and it’s important

Upcoming npm v12 will disable preinstall, install, and postinstall scripts from dependencies unless allow-listed. You can prepare for this change using npm v11 now: github.com/orgs/communi...

Nub is a new frontend for Node by @colinhacks.com ✨ 🦀 A Rust CLI 🧱 Bundler-style JS/TS/JSX transpilation ⚡️ Fast script execution 📦 A new package manager based on Aube 🔢 Node version management The name is similar to Bun. github.com/nubjs/nub

WHATWG Stage 1! bsky.app/profile/mari...

🚀 We're kicking off another Socket Launch Week, introducing one new feature every day this week! Day 1 is a big one: Socket for Linear is now available. Turn Socket alerts into Linear issues automatically, with two-way sync that keeps both sides current as things change.

Oh. After many long years... HTTP now officially has a standard QUERY method. Think: cacheable, idempotent GET that can carry a meaningful payload. We can now all stop bastardizing POST. auth48-transition.rfc-editor.org/authors/rfc1...

Given the feedback, we decided to move forward and start verifying maintainers and projects in the npm ecosystem. Later on, large ecosystem projects could also become verifiers for their communities. Reach out if you're interested in these conversations! Here are the first 100+ verifications 🩷

Andrew Becherer is joining Socket as our first CISO. He was Datadog's first security hire and led security there through its IPO. Socket protects 27,000+ orgs. Andrew will own how we protect ourselves and how we show up for the security teams we serve. socket.dev/blog/andrew-...

Today I gave a talk JSNation about the life cycle of ESM in Node.js, how it differs in other environments and the new features that will affect these stages. Slides: github.com/joyeecheung/...

🔥 Socket Firewall is now built into Replit's AI-powered development experience. It’s already blocking 8K malicious packages/day across builders on the platform, giving Replit users stronger protection by default at the moment dependencies are introduced. socket.dev/blog/socket-...

npm accidentally marked a bunch of one-character packages as security holders, including c, i, n, x, several numbers, and even the - package. The registry confirmed it was a tooling bug and said a rollback is underway. socket.dev/blog/npm-too...

Rich, native experiences, now *enhanced* with a floating black bubble vomiting 300 lines of tiny white text right in your face, not *replaced* by it. #WWDC26

after about two years of the package existing, tinyglobby has surpassed both globby and fast-glob. it's been an insane journey that wouldn't have been possible without @e18e.dev and help from people like @benmccann.com or @43081j.com. i'm infinitely grateful for what e18e has done to the ecosystem 💙

I have some early benchmark results with my custom @pnpm.io registry. In different scenarios, overall install times are 2 to 7 times faster than even the already very fast pnpm in Rust. Looks promising.

I'm joining the Web Platform team at Microsoft! We are at a pivotal moment that raises a lot of interesting questions for the web and how it should evolve. I'm looking forward to working with this great team and the broader industry during this exciting era!

We're changing how single-character inference in template literals works in TypeScript 7.0 TL;DR

Type-stripping (used in Node's *.ts support) continues to pay dividends 👍 Masaki Hara found some type syntax that was unexpectedly not erasable: adding type assertions changed the precedence of the underlying JS code 😮 Anders on the TypeScript team universally fixed it in TS 7.0 via new errors 🎉

👀 pnpm registry you say??

The profits argument is weakened when a company is so massive and has many levers to fund a variety of things. It’s like a government that chooses to spend on endless wars instead of investing in social programs. It’s a deliberate choice.

thank @leobalter.bsky.social - he's the hero we (and microsoft) doesn't deserve if staging had shipped in 2020, shai hulud would never have happened.

to whoever moved mountains to ship staged publishing in npm, thank you.

Woooo yeaaah! The missing piece 🎉 everything is about to get a lot more secure

💥 Read our full official announcement: socket.dev/blog/series-c

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

Node.js 26.2.0 is out! `stream.compose` is now stable, `node:fs` integrates with the new `Temporal` API, and a fair load of bug fixes. Full changelog and download links at nodejs.org/en/blog/rele...

Games Industry plant

As a multimedia major, without a formal CS education, I feel this. AI gets the artistic flow and imagination running

Had a few thoughts I needed to get out of my head this morning. www.jasnell.me/posts/open-s...

🔺 Socket is releasing free Certified Patches for a critical sandbox escape vulnerability in vm2. The advisory flags only vm2 3.10.4 on Node 25, but we found it affects all versions before 3.10.5 on Node.js runtimes with WebAssembly.JSTag, including Node.js 24.x. socket.dev/blog/free-ce...

GitHub Actions is working on a feature to generate a lockfile to properly pin the version of the actions in your workflow yaml github.com/orgs/communi...

🚀Rolldown 1.0 is here!🚀 Rust-based high-performance JavaScript bundler. 🏎️ Runs at native speed that’s up 30x faster than Rollup 🤝 Compatible with existing Rollup & Vite plugins ⚡The underlying bunder for Vite After 2 years, Rolldown is officially stable and has 20+M weekly downloads.

I’m old enough to remember when Jake was a googler 🤷‍♂️