I have someone in my email from GitNation asking about a tech speaking thing. I have never heard of them, but their website has names of people I know. Is this legitimate or spam?

It's not only NPM.

Looks like I was right! bsky.app/profile/reac...

ESLint lost 1/3 of its sponsorships in 2025 while downloads are up 62%. If every company where ESLint is used donated just $100/month, we'd have more than enough. Please talk to your manager about sponsoring ESLint: https://eslint.org/donate

"I've written and deleted a comment enough times here that I need to move on." I am fully on board with a message of: Show me that you looked at the code at all. github.com/expressjs/ex...

npm has revoked classic tokens for publishing, pushing maintainers toward OIDC trusted publishing or granular tokens. But @openjsf.org warns trusted publishing still has risky gaps for critical projects. What maintainers should do next: socket.dev/blog/npm-rev... #NodeJS #JavaScript

🧨 “Gaps in design and implementation with the new OIDC Trusted Publisher workflows leave maintainers open to novel and increasingly difficult to detect gaps in their publishing setups. We do not recommend critical projects move to this new workflow..." - @notwes.bsky.social

Want to work with me and a number of world-class JS open source developers at @socket.dev protecting ALL open source libraries from supply chain attacks? We're looking for stellar frontend developers. DM me

❗️Node.js Security release pre-alert ❗️ We will release new versions of v20, v22, v24, v25 release lines on or shortly after the 15th of December 2025 in order to address: * 3 high severity issues. * 1 low severity issue. * 1 medium severity issue. nodejs.org/en/blog/vuln...

Cloudflare was down for half an hour this morning, and it was caused by work we were doing to try to mitigate the React CVE. (Seriously, people: upgrade Next.js/React Router etc right now)

If you haven’t patched any libs you maintain, go do that immediately. This is “as bad as it gets”. We need everything moved past these vulnerable versions because they can *easily* be mistakenly in your apps.

The changed code is a small fraction of an open source contribution. Your commitment to understand the issue, how your proposed solution fits with the project, and be ready to own and push the review process forward is the biggest chunk of the work. Your effort is the contribution, not the code.

Can we just have 1 dull day in JS land?

I always feel bad for people who spend a ton of time on a pull request that the project doesn’t want. You can avoid wasting a lot of time by first opening an issue describing what you’re thinking of doing to get feedback before you start coding.

And as we in JS land have been learning the past 3 months, "devs just need to be careful" in a universe where CI exists is also pretty incredible.

Nothing is ever perfect, but this is pretty good advice.

Developers, please, enable passkey MFA on your npm account. It's extremely easy, and makes this category of attack impossible. At this point, I feel like it's negligent of GitHub not to require this of all publishers.

🤯 The number of affected packages in the Shai-Hulud npm attack has now reached 770. We’re continuing to investigate and will keep the blog post updated: socket.dev/blog/shai-hu...

Another week, another CI compromise leading to malware. This time it might even delete your home directory if it can't find any secrets to steal. What was that again about trusted publishing? You need to trust your CI for it's threat model to apply? Guess maybe that's a bad place to put our trust.

Just got three ficking awesome tacos for 14$. I rode my bike here. The place was a food truck I never noticed around the corner for 6 years and just opened a storefront. Hate on Austin all you want (especially since it’s in Texas) but I still love this place.

🚀 Here is @vlt.sh take on running lifecycle scripts on installs, adding another powerful capability to our query language syntax: blog.vlt.sh/blog/vlt-build #javascript #nodejs #packages

🚀 Big news for JavaScript teams: Socket now supports Bun and vlt in beta. You no longer have to choose between innovation and security. Commit a bun.lock or vlt-lock.json and Socket gives you full supply chain protection.

Launch Week Day 3: We're announcing beta support for @bun.sh and @vlt.sh package managers in Socket! 🎉 Developers using emerging JavaScript package managers can now rely on Socket for full supply chain security, dependency graph analysis, and accurate SBOMs.

Reporting spam on @github.com should take less effort than posting spam

After a few months of targeted attacks on our ecosystem, followed by a confusing and rapidly changing response from @github.com, we wanted to put together some guidance for maintainers on how to help us all secure our supply chain together. Here is that guidance 👇

🎉 @bjohansebas.bsky.social is our new Triage Captain for #ExpressJS! Grateful for your dedication, leadership, and continued impact on the community 👏👏👏 github.com/expressjs/di...

Have you even lived if you have never opened a kiln that looks like this? That crushing feeling of loss to really brings perspective to normal levels of sad and how to let it go. 😭 Sorry for your loss Eva.

October’s security check‑in is here! 🚨 📌 Highlights: stronger threat modelling, npm Trusted Publishing risks tackled, new runtime features for secure‑by‑default apps. hubs.la/Q03T5j8j0

Nerds (derogatory) are really out there propping up the entire global market so they can have conversations with computers instead of humans. They are doing billions of dollars worth of work to achieve the goal of living a life mostly bereft of human connection. I am watching it happen live. 😭

I had the pleasure of being on-call for a lot of what Elizabeth talked about on this (love is blind & the Tyson fight). It's fun to hear such a polished, clear, and positive message about the absolute *madness* (aka fun) it was to be involved as an engineer on the ground.

Oh cool, thanks Thanks.dev for the support on @github.com.

Type stripping is now stable. Enjoy 🌞

Or to find out what is key for the general community, instead of for a specific funding source, there needs to be people proactively trying to find out what general users want, which is also work that doesn’t get done by itself and largely depends on volunteers github.com/nodejs/next-10

Ha, this is pretty much how I work and I didn't realise it was a cultural thing, but that's why you see me popping up everywhere: (From: protocol.ecologies.info/interviews/n... )

I am not a supplier.

Preparing my talk for JSConf JP and I finally drew my mental venn diagram about how Node.js development works 🤪

And if so, what value are you finding in the data available via provenance?

Big thanks to our partners Alpha Omega and @nodesource.bsky.social 💚

Ever wonder why @nodejs.org drops new versions like clockwork? Here’s the scoop. ⏱️ @rafaelgss.dev shares all the details about the Node.js release schedule in our new series, JavaScript Security Snapshot.

It's not you, it's slack.

My first advice to junior contributors is to STOP using vibe coding for PRs. OSS is always about people more than about code. We don't need more code generated by LLM, we need more people who care.

Mine took down all iOS streaming on Netflix. A year later my former team had rolled out a whole new system in place of the thing that allowed my missed where clause to cause the outage. Good engineering is not about mistakes happening, it is about how you respond after.

"We’re sending a quick reminder to complete our survey about your Technology Help Center (THC) usage." Well....**takes a big puff**...lets do this survey.

Someone at PayPal needs to learn about the importance of alt text. Hope they like immediate delete on their emails.

40 million users on halloween [takes a long drag on a cigarette] no way one of them isn’t a dracula

New collab space alert 👀🚨 We've launched the Bundler Collaboration Space to bring projects like Vite, Webpack, Rspack, and others together on shared goals for the JavaScript bundler ecosystem. Join in: github.com/openjs-found...

I am so happy! Getting back home to Austin and it’s actually chilly. All I wanted to do was go curl up in bed and sleep for a month, and I got the type of weather that makes that feel nice.

I will personally give a free ticket to the next GitHub Universe to the first person to share a UF2 with a playable version of Doom for the GitHub Universe 2025 badge

The line to get into @github.com Universe looked like a 4 hour wait to get o to a roller coaster. Lucky for me I was here yesterday but still got the bacon.

The word “agents” is a new trigger word for me. 🫠