There are a lot of companies creating open source projects, which is great. I'd also like to encourage everyone to support and use independent open source projects. We don't want an ecosystem where all important packages are under the complete control of companies.

“Sentry is one of the few vendors that systematically maps its dependency tree and then actually cuts checks to the people maintaining that stack, as opposed to just talking about ‘giving back.’” He's not wrong, you know. www.theregister.com/2026/03/25/o...

6 years ago I did a prototype of a feature. Today I did the first fully end to end test of that feature on top of systems that weren’t even a concept yet back then. No lessons here, just want to say that not everything needs to move fast to be valuable.

Finally happened. Got hit on my bike by a guy pulling out of a car dealership. I reacted in time to fall and only have my front tire hit his passenger side tire. No injury. But then I banged on his window and he got out and called me a psycho. He was so oblivious he didn’t even see that he hit me.

ECMAScript Euphoria! 🎉 We don't always post when a single proposal advances, but when we do, it's Temporal -> Stage 4. Just days shy of 9 years from Stage 1, a herculean effort on the part of many champions, delegates, invited experts, and contributors, past and present. Thank you all! 🙌

People next to me at the coffee shop this morning are fascinating. While talking about using AI in their dev workflows one guy says "I never leave my house"... ...and it all made sense.

This is exactly what I love about #OSS You pick up an issue, learn, iterate, share, exchange, ship something useful, and make it better for everyone. 💖 npmx //Happy coding

After implementing web streams in multiple runtimes, supporting them for years, talking with other implementers, dealing with issues... I think it's well past time we talked about something better blog.cloudflare.com/a-better-web...

for folks who are active on x, threads, etc and feel bad about it bc of its stewards but have a hard time letting go: sometimes your behaviors overpower your values online because tech companies hire psychologists & sociologists to come up with ways to put you in that position

🚨 Active supply chain attack New Shai-Hulud–like npm worm (19+ packages, 2 aliases) stealing dev/CI secrets, injecting GitHub workflows, poisoning AI toolchains, and harvesting LLM API keys. Details → socket.dev/blog/sandwor... #NodeJS #JavaScript

We're excited to announce that Socket is joining the @openjsf.org! Proud to support the #JavaScript ecosystem alongside so many great projects and contributors. socket.dev/blog/socket-...

WHAT EVEN IS A CVE!!! ❓ @ulisesgascon.com breaks it down and explains what a CVE is and how it helps in our latest short. You can view all of the shorts in our series on our YouTube Channel too for more security insights 👀 youtube.com/@OpenJSFound...

Can I pick your brain, folks? Reply with 3 topics you consider advanced in automated testing 👇

I aspire to such an exit.

In case you missed it: we published an overhaul of the old Mocha website. It's on @astro.build Starlight and has most of the same contents as before, just separated into granular pages. 🤎 Next up will be auditing those pages to be more comprehensive and correct. Voila!

🔴 LIVE https://stream.place/pfrazee.com And we are live with office hours!

I see myself!

The @vlt.sh benchmark suite has been updated to include the yarn v6 canaries (still a WIP & improving all the time): benchmarks.vlt.sh

Trust is interesting because it’s not quantifiable but it certainly is palpable. Teams with trust move lightning speeds faster than those without.

This is exactly the kind of thing people worry about with browser extensions. It looks like an Amazon ad blocker, but quietly hijacks affiliate links in the background. Most people aren’t reading extension source code (and if you are, congrats 🙃), which is why this works.

🙋‍♂️ so ... for reasons: I would love to know people's frustrations with: - the current npmjs.com - admin user flows on npm web ui (and cli, locally) 🙏

This was a great watch. I don't know what I expected when clicking, but it surprised me with heartfelt moments, humor, and really great focus on the humans that are a part of this thing we call open source.

Bottomless thanks to @vlad.website for all the feedback and support and encouragement and help to get this out the door! It's far from perfect, but it's a much stronger video because of him. 🙏

Inbox: 2 by the second work week of the year shouldn't make me feel this accomplished. Something is wrong with me.

🎉 The codemods to migrate Express to version 5 are now available on codemod.com! 👉 Run the recipe: npx codemod@latest @expressjs/v5-migration-recipe 👉 More codemods here: codemod.link/express #expressjs #codemods #javascript #nodejs

Burnt my whole mouth on my tea this morning. So yeah, monday really doing it's thing 🤣

Additionally, releasing on Tuesday rather than Friday helps ensure that security updates are available during regular business hours across all time zones, particularly for our users in the Asia-Pacific region. nodejs.org/en/blog/vuln...

🚨Our team has decided to postpone the release to Tuesday, January 13th, 2026. This additional time will allow us to properly test all backports and re-run CITGM to ensure the highest quality for our users.

We've heard people like Starter Packs, so we just begun putting one together for open source organizations. It could be an OSPO like us, a Foundation that supports projects and the ecosystem or accounts for OSS events. Take a look and tell us who else should be there. go.bsky.app/Te7sTt9

Like the rest of the internet, Sentry runs on Open Source. Like the rest of the @opensourcepledge.com companies, we also believe in paying it back. In 2025, we gave out $750k to the OSS projects we rely on; here’s a sampling of some of them, and why they are so crucial 🧵

Haha thanks! You & @chadwhitacre.com & @sentry.io putting so much time & effort & money into @opensourcepledge.com & sponsorships was a big reason why I joined Sentry. It speaks positively and strongly about the company culture and motivations and people!

It's a new year 🎉 Are you currently hiring for a role that includes using Node.js? Reply with a link to the opening and any relevant context. If you're not, we'd appreciate a repost for visibility 💚

TIL that modern Node not only supports `--env-file` / `--env-file-if-exists` but also a new method to programmatically load .env files. It's been marked stable since Node v24 (current LTS), and I'm now on the journey of removing all the `dotenv` dependencies. 😅 www.stefanjudis.com/today-i-lear...

And yet it’s one of the most insightful and powerful statements one can make. Realizing and admitting that one simply don’t know the answer. If only more people were capable of realizing and strong enough to admit it. Would solve a lot of things in this world.

Look, I won't judge what folks were doing 11 years ago but if you do anything like this in your packages in the year 2026 please reconsider: socket.dev/npm/package/...

Honestly, this screenshot from slack right here fully captures my essence day. 8 years and I still just don't know.

I made something new: an eslint plugin to validate your npm ecosystem lockfiles! It supports npm, pnpm, yarn, bun, and vlt, and it's already helped find a supply chain security attack vector inside a fortune 500 tech company. www.npmjs.com/package/esli...

Can we just all agree to extend the holiday break a bit longer? Maybe into March?

Oh hi. 👋 We're back with the latest Security Snapshot that covers how to publish to npm safely and with ease. ✨ @rafaelgss.dev breaks down why local publishing with 2FA gives you the safest setup right now.

I have someone in my email from GitNation asking about a tech speaking thing. I have never heard of them, but their website has names of people I know. Is this legitimate or spam?

It's not only NPM.

Looks like I was right! bsky.app/profile/reac...

ESLint lost 1/3 of its sponsorships in 2025 while downloads are up 62%. If every company where ESLint is used donated just $100/month, we'd have more than enough. Please talk to your manager about sponsoring ESLint: https://eslint.org/donate

"I've written and deleted a comment enough times here that I need to move on." I am fully on board with a message of: Show me that you looked at the code at all. github.com/expressjs/ex...

npm has revoked classic tokens for publishing, pushing maintainers toward OIDC trusted publishing or granular tokens. But @openjsf.org warns trusted publishing still has risky gaps for critical projects. What maintainers should do next: socket.dev/blog/npm-rev... #NodeJS #JavaScript

🧨 “Gaps in design and implementation with the new OIDC Trusted Publisher workflows leave maintainers open to novel and increasingly difficult to detect gaps in their publishing setups. We do not recommend critical projects move to this new workflow..." - @notwes.bsky.social

Want to work with me and a number of world-class JS open source developers at @socket.dev protecting ALL open source libraries from supply chain attacks? We're looking for stellar frontend developers. DM me

❗️Node.js Security release pre-alert ❗️ We will release new versions of v20, v22, v24, v25 release lines on or shortly after the 15th of December 2025 in order to address: * 3 high severity issues. * 1 low severity issue. * 1 medium severity issue. nodejs.org/en/blog/vuln...

Cloudflare was down for half an hour this morning, and it was caused by work we were doing to try to mitigate the React CVE. (Seriously, people: upgrade Next.js/React Router etc right now)

If you haven’t patched any libs you maintain, go do that immediately. This is “as bad as it gets”. We need everything moved past these vulnerable versions because they can *easily* be mistakenly in your apps.