Looks like the DTLS implementation has a fair chance of landing in Node.js soon so I wrote up a blog post about it www.jasnell.me/posts/experi...

Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.

Woooo yeaaah! The missing piece 🎉 everything is about to get a lot more secure

Axel is perhaps the most professional and diligent JS educating author. I remember when it felt like a new JS feature wasn't "done" until he had written the corresponding explainer article. You can thank him by buying his books 📚

🧊 Big release for #JavaScript supply chain security: @pnpm.io 11 now defaults to a 1-day Minimum Release Age, blocks exotic subdependencies, and adds a new Allow Builds model. A strong step toward reducing exposure to fast-moving npm attacks → socket.dev/blog/pnpm-11... #nodejs

have to tell you, Microsoft really cooked with apm (agent package manager) and it is so underrated... highly recommend

Reminder: Node.js v20 is end-of-life (EOL) today. Upgrade + get security support for EOL versions here: https://nodejs.org/en/about/eol

I'm going to follow Frank's advice and also update my open source contribution guidelines on my repos on GitHub with this kinda wonder though to which extent do AI agents actually parse the CONTRIBUTING.md file. Maybe I should stick this into README.md too.

20x lower median latency than HPA. 6x lower than KEDA. 17x fewer failed requests than HPA. 9x fewer than KEDA. Same app. Same cluster. Same metric. The only thing we changed was the autoscaler. 🧵

Not to take you out of any kind of discourse, fam, but next Friday it's David Attenborough's 100th birthday. How do you plan to celebrate?

Reminder: The NodeConf EU 2026 Call for Proposals is open: forms.gle/KV4QaCQEBfbX... Get your submissions in!

We've shipped more than a thousand versions of Zed, but all of them began with zero. Today, that changes. zed.dev/blog/zed-1-0

ECMAScript excitement 😉 Congrats to @bartlomieju.bsky.social on landing experimental (flagged) support for @tc39.es Stage 3 Import Defer in upstream Deno 🎉 import defer * as lazyNs from "expensive"; Module evaluation is delayed until the first namespace access. github.com/denoland/den...

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

Node excitement 😉 Congrats to @targos.dev on landing the V8 14.6 upgrade in upstream Node, heading for Node v26 which will be released very soon 🎉 This is the first version of V8 in Node to support unflagged Temporal 👍 github.com/nodejs/node/...

PSA: "Organizations that used the affected image to scan Terraform, CloudFormation, or Kubernetes configurations should consider any secrets or credentials exposed to those scans potentially at risk."

Reminder: get your NodeConf EU 2026 talk proposals in: docs.google.com/forms/d/e/1F...

This is where I want to be in September BTW

We are happy to announce the NodeConf EU is returning in 2026. This time, things will be a little different. While the Irish countryside made for a beauttiful backdrop for getting the community together to talk about Node.js, there have always been a number of logistical challenges to hosting there;

We’re fundraising to build everything we need to operate without Bluesky. Our €100,000 target will accelerate our goal of building a European app backend (Appview) and a microblogging app. Since last night over 282 of you contributed more than €5,000. Let's do this! fund.eurosky.tech

Congrats to @heimskr.io at Apple (previously at Bun) on landing this complex & critical JS ecosystem fix in WebKit's JSC 👍

Exciting things happening over at Eurosky! I particularly love how the Atmosphere angle is landing. Amazing job from the team! 🪩🔥💗

Switzerland gets 25 Gbit internet because it treats fibre as shared infrastructure—one network, multiple competing service providers. The US & Germany let companies dig parallel trenches. Natural monopolies work best when you regulate the infrastructure, not pretend competition will magically appear

y'all coming to AI Native DevCon in London tessl.io/devcon/? would love to see ya there (June 1-2) and talk about agentic development security topics, I'm sure you have many questions! 😉

the real extreme programming is cutting releases on Fridays.

Our team received a report of intermittent app outages at about 11:40pm PDT on April 15, 2026. They worked through the night to mitigate a sophisticated Distributed Denial-of-Service (DDoS) attack, which intensified throughout the day.

🎉 We're excited to share that Socket is one of the initial recipients of OpenAI's Cybersecurity Grant Program, alongside Semgrep, Calif, and Trail of Bits. More on how we're putting frontier models to work defending open source → socket.dev/blog/openai-...

btw I periodically have to recommend runcat because it rules. the kitty runs faster when cpu goes up apps.apple.com/us/app/runca...

avoid the next malicious package disaster with pnpm security hardening: github.com/lirantal/npm... Security Best Practice: Set trustPolicy: no-downgrade so that pnpm refuses to install any package version whose trust evidence is weaker than a previously published version of that package

The peril of laziness lost bcantrill.dtrace.org/2026/04/12/t...

automate the world's misinformation is the new organize the world's information

Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years. That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn't think PQ auth was so urgent until recently.

We've been worrying about UX patterns that train users into dangerous behaviors for a while, but they weren't exploited often. Alas, it looks like it was just because there was lower-hanging fruit. We've been improving auth stories, so now targeted phishing is moving to looking like innocent UX.

while we're on the topic of axios malware and supply chain security... I have friends who do blind upgrades in CI and other places. please don't be them. never blindly install software. npm install == sh -c. not worth it.

A historic day for Ecma specs 😉

🚨 NOT AN EARLY APRIL FOOLS! 🚨 Active supply chain attack on [email protected]. The latest version pulls in [email protected] -- a brand-new package that didn't exist before today! If you use axios, pin your version and audit your lockfile. Socket's Analysis: socket.dev/blog/axios-n...

FYI on April 24th GitHub will begin training on your code for GitHub Copilot so unless you want this forced default opt-in, go to settings and disable 👇

Upgrading my git experience: brew install difftastic mergiraf

slop is something that takes more human effort to consume than it took to produce. When my coworker sends me raw Gemini output he’s not expressing his freedom to create, he’s disrespecting the value of my time

noq is a new QUIC library in town, written in rust: https://www.iroh.computer/blog/noq-announcement

new post on my personal blog. i think these three areas often go unexplained, so hopefully this explains why some of these packages exist. these are fine to exist but the majority of developers shouldn't have to pay the cost for them.

Matteo you're in my project 😉 Good collection of skills there at github:mcollina/skills - thanks buddy! Heads up, this uses Tessl skills manager so I can version, compose and track these agent skills. Nice CLI. Recommend.

.@nodejs has always been about I/O. Streams, buffers, sockets, files. But there's a gap that has bugged me for years: you can't virtualize the filesystem. You can't import a module that only exists in memory. You can't bundle assets into a Single Executable without patching half of core. 👇

ECMAScript excitement 😉 This week in NY @tc39.es advanced these proposals 🎉 4⃣ Intl Era/Month Code 4⃣ Temporal 3⃣ Import Text 2⃣.7⃣ Error Stack Accessor 2⃣.7⃣ Iterator Includes 2⃣ Intl Unit Protocol 2⃣ Thenable Curtailment 1⃣ Error Code Property 🗑️ Dynamic Import Host Adjustment

Looking forward to reunite with friends for 𝐀𝐈 𝐍𝐚𝐭𝐢𝐯𝐞 𝐃𝐞𝐯𝐂𝐨𝐧 2026 in London on June 1-2 You'll learn about building real AI-native systems at production scale and my talk is going to be on AI Agents and Skill Security ✨ RSVP: tessl.io/devcon

pnpm + Git Worktrees for Multi-Agent Development pnpm.io/11.x/git-wor...

TransformStream will be up to 16% faster across the board in Deno v2.7.6. No changes needed in user code. github.com/denoland/den...

So here's why we experienced a problem with Eurosky last night 🧵 Our systems (the PDS) were up and running as normal. The issue was that data from our systems stopped flowing into the part of the network (the relay) that lead to the Bluesky app.