Welcome @rafaelgss.dev to the @openjsf.org #CNA team! 👏 👏 👏 github.com/openjs-found...

This got me thinking. I have been trying out this pattern of doing a `setup` script in projects. The idea being to run `node --run setup` when you clone down a project, and that script does your package manager install. It is working great for me so far, and almost fully replaces what corepack did.

Be a help, not a hindrance. I have been both at times (well I like to think I have been a help sometimes) and agree: most of the time you *shouldn't* write a new lib. Especially if there is an option to solve the problem with "a methodology".

Anyone else miss whiteboards as much as I do? No? Just me?

Seeing the recent supply-chain attacks made me prioritize this item from our backlog as I wanted a quick way to know if any of my local projects have been affected. Meet the new vlt client `:host()` Query selector: blog.vlt.sh/blog/host-co... #javascript #nodejs #packages

Welcome @bjohansebas.bsky.social to the @expressjs.bsky.social Security Triage team! 👏 👏 👏 github.com/expressjs/se...

Our goal is to provide guidance and tooling for perf based decisions to the maintainers under our umbrella. Aligning our philosophy for how/what we monitor and how to interpret the results lets us be consistent across our 50+ packages. Ive been learning a lot so far, and big ty to @rafaelgss.dev

I've published my perspective of the @ctrl/tinycolor NPM supply chain attack. This whole thing got me to finally make a blog. sigh.dev/posts/ctrl-t...

Lots of GREAT progress and discussion on our @expressjs.bsky.social Performance Working Group. Thanks everyone who is participating as I think this is the second most (security comes first) impactful thing we could be working on. For anyone interested in helping out: github.com/expressjs/pe...

Good credentials != Good code...

This is not over. 👇 🚨 A new wave of the npm supply chain attack just hit again. This time targeting CrowdStrike packages. Socket detected malware-laced updates that steal developer creds, spin up rogue GitHub Actions, and exfiltrate secrets. Developing story...

This is not over. 👇 Another wave of these npm supply chain attacks just hit this morning, less than 24 hours later. This time targeting Crowdstrike packages (!!) bsky.app/profile/fero...

More today. socket.dev/blog/ongoing...

🚨 Malicious update to @ctrl/tinycolor on npm is part of an active supply chain attack hitting 40+ packages across multiple maintainers. Audit & remove affected versions. Our analysis of the malware: socket.dev/blog/tinycol... #NodeJS #JavaScript

socket.dev/blog/tinycol... Updates continuing as we speak.

Honestly serious: JUST DON'T UPDATE PACKAGES RIGHT NOW. It is unclear to me yet, but this is looking pretty wide spread. Better be safe than sorry, just go touch some grass.

Do not update to @ctrl/[email protected]. It has malware that is currently live on npm.

I don’t care what language you are working in: writing your code with branches dependent on the “type” of environment is wrong. Full stop.

What do people think of this? github.com/orgs/nodejs/... node.config.json => package.json cc @marcoippolito.dev

The more I have to post about this secure publishing stuff the more I’m sure that we need training classes for OSS maintainers. It’s pretty complicated, and unless @github.com is going to finally do something about it, I am not sure there is any other way to fix the problem at scale.

The maintainer of one of our dependencies, debug, was the target of a phishing attack resulting in the release of [email protected] with malware. Supply chain security is all of our responsibilities. Be careful out there, and for today don't update your deps. socket.dev/blog/npm-aut...

I commented on one @gitlab.com issue about line wrapping in like 2017 and I am STILL getting emails about it. How are you all doing over there GitLab? You alright?

Weekend throwing is almost enough to get me back to “production” mode. 6 cups with no mess, getting close to being able to do matching sets, and less than an hour from setup to clean up.

🔒 Securing #OpenSource projects is not an easy task. ✨ Here’s a great #initiative helping the #maintainers and community move forward: 👉 openjsf.org/blog/securit...

New tagline on the @opensourcepledge.com homepage. “Together, we pay the maintainers.” Join the club! 😁💃

If you're already a Node.js Collaborator, feel free to submit proposals for a session! If you want to get involved in the project, this is a great way to start 🙂

🌐 Reminder from the Node.js TSC meeting today: We're having a Collaborator Summit next October 17th! github.com/openjs-found...

🚨 Supply chain attack on Nx npm packages (4.6M weekly downloads) Malware abused AI CLI tools (Claude, Gemini, Q) to steal creds + wallets, then exfiltrated to GitHub repos (s1ngularity-repository*). More than 1,000 victim accounts confirmed. 🔗 socket.dev/blog/nx-pack... #nodejs

Can someone tell me if this is a bad idea? github.com/wesleytodd/n... Maybe @nodeland.dev? If not maybe I will open the PR.

A great example of why provenance is useless without 2fa: github.com/nrwl/nx/issu...

Interesting how so many projects are now improving docs & error messages "so LLMs can understand." 🤖 Was making them clear for humans not a good enough reason already?

Ok these cups are gonna break all the right rules.

Who ever said you shouldn’t glaze the bottoms of your pieces?

Go see your local theatre! Wizard of Oz is killing it on the pre show!

To enhance security of publishing npm packages locally, I’ve enabled 2FA for publishing `npm profile enable-2fa auth-and-writes` To make the process both secure and convenient, especially for 1Password users, I created a package that automatically enters the OTP code for you. github.com/sxzz/unotp

Has anyone ever put together a slide show of the funny thumbnails youtube picks from the OSS meetings we have? Just scrolled the live tab for @nodejs.org and its too funny.

The @expressjs.bsky.social project has helped transfer over iconv-lite (with the awesome effort of @bjohansebas.bsky.social). Hopefully we can be a good home for this package which adds another 446M monthly downloads to the projects scope. github.com/pillarjs/ico...

And it is official, Genuine Joe's is being torn down. End of an era. 😭

Wrote a lot of thoughts on junior developers, AI, and what I strongly feel is going to become the defining challenge of our industry's next generation. www.zacsweers.dev/forklifts-re...

Just asked a teammate to run a branch of mine (its a tool we are bulidng wrapping @turborepo.com) on one of our larger customer monorepos. It rebooted his laptop. Maybe it is just since it is Friday afternoon, but I cant stop laughing about it. In case you were wondering, dont set --concurrency=999

🚀 Dependency Selector Syntax can now be used across @vlt.sh commands like run, exec, and pkg! This enables precise filtering when running scripts, executing commands, or getting package info. You have access to the whole graph! Read more about how it works and some example use cases:

Supply Chain Attack Summer continues.

Hey, you! Want to protect your dev machine from npm malware without changing your workflow? Try a new tool that transparently isolates npm cli in a docker container without you having to remember to do anything! Early access: github.com/lavamoat/kip... RT for reach 😉 and help me improve

That risks removing the very edge that open source has, reducing it to yet another code based produced for profit with features selected for hype and publicity rather than dogfooding.

The strength of open source is that its be peer-to-peer developed, not a producer to consumer relationship. Yet most sustainability efforts focus on unlocking funding to pay for production of open source, not unlocking a wider contribution base of equal peers.

People call way too much code "boilerplate code." If your plumber complained as much about adhesives and seals and skipped them as our industry does around this "boilerplate" you'd have a very nasty house.

Want to see what we've accomplished with the node.js ‘userland-migrations’ initiative? Check out these awesome codemods codemod.link/nodejs-offic... I hope your depreciation is already supported. If not, go to git.new/userland-mig...

I'm going to be speaking at JSConf US in October ⭐️ jsconf2025.sched.com/event/26Ubg

✨ Proud to be one of the maintainers of @expressjs.bsky.social in the @github.com Secure Open Source Fund! Securing the #OpenSource #SupplyChain is a team sport 💚 github.blog/open-source/...