WHAT EVEN IS A CVE!!! ❓ @ulisesgascon.com breaks it down and explains what a CVE is and how it helps in our latest short. You can view all of the shorts in our series on our YouTube Channel too for more security insights 👀 youtube.com/@OpenJSFound...

Can I pick your brain, folks? Reply with 3 topics you consider advanced in automated testing 👇

I aspire to such an exit.

In case you missed it: we published an overhaul of the old Mocha website. It's on @astro.build Starlight and has most of the same contents as before, just separated into granular pages. 🤎 Next up will be auditing those pages to be more comprehensive and correct. Voila!

🔴 LIVE https://stream.place/pfrazee.com And we are live with office hours!

I see myself!

The @vlt.sh benchmark suite has been updated to include the yarn v6 canaries (still a WIP & improving all the time): benchmarks.vlt.sh

Trust is interesting because it’s not quantifiable but it certainly is palpable. Teams with trust move lightning speeds faster than those without.

This is exactly the kind of thing people worry about with browser extensions. It looks like an Amazon ad blocker, but quietly hijacks affiliate links in the background. Most people aren’t reading extension source code (and if you are, congrats 🙃), which is why this works.

🙋‍♂️ so ... for reasons: I would love to know people's frustrations with: - the current npmjs.com - admin user flows on npm web ui (and cli, locally) 🙏

This was a great watch. I don't know what I expected when clicking, but it surprised me with heartfelt moments, humor, and really great focus on the humans that are a part of this thing we call open source.

Bottomless thanks to @vlad.website for all the feedback and support and encouragement and help to get this out the door! It's far from perfect, but it's a much stronger video because of him. 🙏

Inbox: 2 by the second work week of the year shouldn't make me feel this accomplished. Something is wrong with me.

🎉 The codemods to migrate Express to version 5 are now available on codemod.com! 👉 Run the recipe: npx codemod@latest @expressjs/v5-migration-recipe 👉 More codemods here: codemod.link/express #expressjs #codemods #javascript #nodejs

Burnt my whole mouth on my tea this morning. So yeah, monday really doing it's thing 🤣

Additionally, releasing on Tuesday rather than Friday helps ensure that security updates are available during regular business hours across all time zones, particularly for our users in the Asia-Pacific region. nodejs.org/en/blog/vuln...

🚨Our team has decided to postpone the release to Tuesday, January 13th, 2026. This additional time will allow us to properly test all backports and re-run CITGM to ensure the highest quality for our users.

We've heard people like Starter Packs, so we just begun putting one together for open source organizations. It could be an OSPO like us, a Foundation that supports projects and the ecosystem or accounts for OSS events. Take a look and tell us who else should be there. go.bsky.app/Te7sTt9

Like the rest of the internet, Sentry runs on Open Source. Like the rest of the @opensourcepledge.com companies, we also believe in paying it back. In 2025, we gave out $750k to the OSS projects we rely on; here’s a sampling of some of them, and why they are so crucial 🧵

Haha thanks! You & @chadwhitacre.com & @sentry.io putting so much time & effort & money into @opensourcepledge.com & sponsorships was a big reason why I joined Sentry. It speaks positively and strongly about the company culture and motivations and people!

It's a new year 🎉 Are you currently hiring for a role that includes using Node.js? Reply with a link to the opening and any relevant context. If you're not, we'd appreciate a repost for visibility 💚

TIL that modern Node not only supports `--env-file` / `--env-file-if-exists` but also a new method to programmatically load .env files. It's been marked stable since Node v24 (current LTS), and I'm now on the journey of removing all the `dotenv` dependencies. 😅 www.stefanjudis.com/today-i-lear...

And yet it’s one of the most insightful and powerful statements one can make. Realizing and admitting that one simply don’t know the answer. If only more people were capable of realizing and strong enough to admit it. Would solve a lot of things in this world.

Look, I won't judge what folks were doing 11 years ago but if you do anything like this in your packages in the year 2026 please reconsider: socket.dev/npm/package/...

Honestly, this screenshot from slack right here fully captures my essence day. 8 years and I still just don't know.

I made something new: an eslint plugin to validate your npm ecosystem lockfiles! It supports npm, pnpm, yarn, bun, and vlt, and it's already helped find a supply chain security attack vector inside a fortune 500 tech company. www.npmjs.com/package/esli...

Can we just all agree to extend the holiday break a bit longer? Maybe into March?

Oh hi. 👋 We're back with the latest Security Snapshot that covers how to publish to npm safely and with ease. ✨ @rafaelgss.dev breaks down why local publishing with 2FA gives you the safest setup right now.

I have someone in my email from GitNation asking about a tech speaking thing. I have never heard of them, but their website has names of people I know. Is this legitimate or spam?

It's not only NPM.

Looks like I was right! bsky.app/profile/reac...

ESLint lost 1/3 of its sponsorships in 2025 while downloads are up 62%. If every company where ESLint is used donated just $100/month, we'd have more than enough. Please talk to your manager about sponsoring ESLint: https://eslint.org/donate

"I've written and deleted a comment enough times here that I need to move on." I am fully on board with a message of: Show me that you looked at the code at all. github.com/expressjs/ex...

npm has revoked classic tokens for publishing, pushing maintainers toward OIDC trusted publishing or granular tokens. But @openjsf.org warns trusted publishing still has risky gaps for critical projects. What maintainers should do next: socket.dev/blog/npm-rev... #NodeJS #JavaScript

🧨 “Gaps in design and implementation with the new OIDC Trusted Publisher workflows leave maintainers open to novel and increasingly difficult to detect gaps in their publishing setups. We do not recommend critical projects move to this new workflow..." - @notwes.bsky.social

Want to work with me and a number of world-class JS open source developers at @socket.dev protecting ALL open source libraries from supply chain attacks? We're looking for stellar frontend developers. DM me

❗️Node.js Security release pre-alert ❗️ We will release new versions of v20, v22, v24, v25 release lines on or shortly after the 15th of December 2025 in order to address: * 3 high severity issues. * 1 low severity issue. * 1 medium severity issue. nodejs.org/en/blog/vuln...

Cloudflare was down for half an hour this morning, and it was caused by work we were doing to try to mitigate the React CVE. (Seriously, people: upgrade Next.js/React Router etc right now)

If you haven’t patched any libs you maintain, go do that immediately. This is “as bad as it gets”. We need everything moved past these vulnerable versions because they can *easily* be mistakenly in your apps.

The changed code is a small fraction of an open source contribution. Your commitment to understand the issue, how your proposed solution fits with the project, and be ready to own and push the review process forward is the biggest chunk of the work. Your effort is the contribution, not the code.

Can we just have 1 dull day in JS land?

I always feel bad for people who spend a ton of time on a pull request that the project doesn’t want. You can avoid wasting a lot of time by first opening an issue describing what you’re thinking of doing to get feedback before you start coding.

And as we in JS land have been learning the past 3 months, "devs just need to be careful" in a universe where CI exists is also pretty incredible.

Nothing is ever perfect, but this is pretty good advice.

Developers, please, enable passkey MFA on your npm account. It's extremely easy, and makes this category of attack impossible. At this point, I feel like it's negligent of GitHub not to require this of all publishers.

🤯 The number of affected packages in the Shai-Hulud npm attack has now reached 770. We’re continuing to investigate and will keep the blog post updated: socket.dev/blog/shai-hu...

Another week, another CI compromise leading to malware. This time it might even delete your home directory if it can't find any secrets to steal. What was that again about trusted publishing? You need to trust your CI for it's threat model to apply? Guess maybe that's a bad place to put our trust.

Just got three ficking awesome tacos for 14$. I rode my bike here. The place was a food truck I never noticed around the corner for 6 years and just opened a storefront. Hate on Austin all you want (especially since it’s in Texas) but I still love this place.

🚀 Here is @vlt.sh take on running lifecycle scripts on installs, adding another powerful capability to our query language syntax: blog.vlt.sh/blog/vlt-build #javascript #nodejs #packages

🚀 Big news for JavaScript teams: Socket now supports Bun and vlt in beta. You no longer have to choose between innovation and security. Commit a bun.lock or vlt-lock.json and Socket gives you full supply chain protection.