A new look for @expressjs.bsky.social is live. Big thanks to @bjohansebas.me and the website team. And a HUGE thanks for @orama.com for the design collaboration. They were awesome to work with on this. expressjs.com/en/ bsky.app/profile/expr...

I’m happy to announce that Express.js documentation has a new look! 🎉 This was a huge team effort with more than a year of work behind it. Thanks to everyone involved for the support and dedication that made this launch possible. expressjs.com/en/blog/2026...

One thing I find super strange is as industry most of us just seem to gloss over the fact we had to steal everyone’s work for these AI tools to exist. Regardless if these tools are useful we can’t just be ok with this right?

I know nothing about what is going on in British politics right now, but I want you all to know this has been a confusing week on Bluesky for those of us named Wes.

It‘s fiiiine …

This is awesome!! Check out @vlt.sh for this in the JS ecosystem. www.vlt.io/products/rep...

Maintainers having to do this type of work is incredibly wasteful and such a fundamental miss by GH.

⚡️ Quick reminder - this holds true for this last wave of attacks/exploits... what's stopping you from using vlt today?

It’s me! Glad to see other folks with this outlook.

npm needs to change their logo

The TanStack attack is CI-based, but the lesson is the same: verifying identity doesn't verify intent.

In the Axios compromise, the attacker hijacked the maintainer's live browser session. As far as npm and GitHub were concerned, they *were* the maintainer. Provenance would have attested to the right person.

This is exactly what I wrote about last week: trusted publishing / provenance tells you WHO published, not WHETHER they were in control.

Like I put together a whole session for the collab summit last year at JS Conf NA. And almost everyone, including many incredibly competent devs, thought I was being too conservative on my posture. Only now is this story getting attention because it was directly exploited: bsky.app/profile/node...

Cant wait for you all to get your prod servers owned because you put a cooldown on your deps and dont patch critical CVEs. Remember AI is good at taking “time to exploit” down to minutes. You need those CVE patches in prod, and a cooldown ain’t helping.

The TanStack supply-chain compromise is a masterclass in why "trusted publishing" isn't enough. 🧵

It’s almost as if we said securing GitHub actions is really difficult and maybe it shouldn’t be at the heart of our security model for publishing.

Was a good morning to roll out our @socket.dev firewall integration which had these packages blocked in ~6min from publish.

⚠️ If you use any TanStack package in any of your projects and there's any chance any of them was updated today, stop what you're doing and read this. ... Actually there are 121 non-tanstack packages affected as well, so check the list anyway.

The only exception for me is when the clanker replies with some unhinged hilarious reply I can laugh at.

fucking CHRIST ze3tar.github.io/post-zcrx.html

NodeConf EU is back in Bologna, Italy and it's going to be special 🇮🇹 Great talks, better people, and the kind of hallway track you can't replicate online. Blind tickets? Already gone. CFP open. Regular tickets moving. Join us: www.nodeconf.eu

npm provenance is a building block, not a roof. Until we design publishing infrastructure around the assumption that maintainer identity *will* be compromised, we're building security theater instead of security. adventures.nodeland.dev/archive/why-...

Here's the uncomfortable truth: npm "trusted publishing" uses Sigstore to cryptographically attest who published a package. But in the Axios case, provenance would have attested to exactly the right person. The attacker wasn't impersonating anyone. They were operating as the legitimate maintainer.

Node saw a golden opportunity and they seized it correctly! Thrilled that explaining LTS releases will be so simple moving forward. Beautiful work! 🎊🎉

I am literally incapable of sending a message, posting a skeet, or writing long form prose without a typo making it into the final product. I can even re-read what I wrote 3 times and still will introduce the typeo on the last edit before I send it. I am the living embodiment of the edit button.

The hidden gem is that @nodejs.org majors and LTS cycles got WAY easier to understand: 2026 -> v26 2027 -> v27 2028 -> v28 ... Aall of them go LTS for 18 months meaning each major is supported for 2 years. The new graphic tells the best story here: nodejs.org/en/blog/anno...

The 2026 Node.js London Collaboration Summit trip report is officially live! 🚀 We gathered 50+ contributors to discuss the biggest technical shifts coming to the runtime. Big thanks to Bloomberg for hosting! 🇬🇧 Check out the full recap and recordings here: https://bit.ly/3OHPLmz

devEngines started as @geoffreybooth.bsky.social and I in DMs 2 years ago. It's now supported in @npmjs.bsky.social & @pnpm.io, and later this month will be our recommended way for developers at Netflix to define runtime and package manager versions in their projects. docs.npmjs.com/cli/v11/conf...

Things are bad out there in the software industry but on the bright side one of my main work streams just got pulled into a company wide initiative with a very fun name.

they genuinely work hard and care a lot, but there's only so much you can do when you're handed a shit sandwich and told to make it gourmet

Yes I did just come back from England, why do you ask?

If people complain about atproto not being distributed and don't want to work to improve that situation, tell them to donate some money to the good folks at @eurosky.social so we can have European owned atproto stack for the folks that live here. And if they just want to complain, let them complain.

Show these people the rsky atproto stack, and tell them to use Blacksky if they want to help making atproto more distributed

Bundling dependencies doesn't fix the problems. You hide hide the dependencies while making you package really big. You also don't get the deduplication that NPM does and the user can't control which versions get installed (in case something gets hacked).

To the multiple people this week who said to me ”but Bluesky is not distributed yet” and I replied “yes it is!”

Thanks for the lunch suggestion @tazs.ing!

We are happy to announce the NodeConf EU is returning in 2026. This time, things will be a little different. While the Irish countryside made for a beauttiful backdrop for getting the community together to talk about Node.js, there have always been a number of logistical challenges to hosting there;

we're having a little npmx social tonight in London! come join us for conversation, food, beer, and stickers 🥳 guild.host/events/npmx-...

come get stickers!!!!!!

Meetup time!

How does one run the @eslint.org CLI with a *single* plugin without all the default rules? I know how to do this with the JS api via overrideConfig and overrideConfigFile. I specifically want to run `eslint --config=...` without all the `eslint/defaults/*` configs.

🪿 There are some wild takes out there right now about open source being “dead” after recent supply chain attacks and rapid advances in AI-driven security. Let’s talk goosenomics for a minute. → socket.dev/blog/dont-ki...

I believe this is the year we’ll start to see a shift from employees refusing to adopt AI because it doesn’t work to refusing to adopt AI so that they aren’t training their replacement.

Hopefully I will be at this!

Finally have a reason to use this second monitor I setup in the garage. Watching @nasaartemis.bsky.social reach the moon while I work! Very exciting!

NASA #Artemis II flyby coverage schedule; all times in Eastern. You can follow along live on NASA+ (plus.nasa.gov) or on the NASA YouTube channel (www.youtube.com/@NASA). It should be amazing to watch!

I tip my hat to everyone out there that is doing the thankless, unpaid work to ensure their environments & software stays safe/secure. At @vlt.sh we're giving back (ex. @opensourcepledge.com) & building a package manager that attacks the last mile problem with a zero trust approach.

Yep I remember saying how wild it is that OSS gets no support despite being the backbone of all our critical software. It’s the perfect type of thing for governments to fund programs around.

Look, I’m in the news, like a lot of other maintainers 🤓 Scary stuff this