OpenAI employees are very excited about how well their new AI tool can create fake videos of people doing crimes and have definitely thought through all the implications of this

Other than the trusted publishing stuff (which is absolutely not ready for use yet, I will be outlining why in my JS Conf talk) this is a great write up of the recent goings on.

A propos of nothing, it's a completely reasonable thing to not use a company's products, services, and OSS, when their CEO openly supports (and takes selfies with) a world leader who the UN says is currently committing genocide.

🚨 Open source supply chain attacks are exploding. Starting today, that ends. We’re releasing Socket Firewall — FREE, zero-config, CLI that blocks malware before it lands on your laptop or CI. Just run: npm i -g sfw sfw npm install lodash Works for: npm, yarn, pnpm, pip, uv, and cargo.

There was a period during my time at Chrome where a well-resourced sub team did significant amounts of free work for Vercel. This included giving Rauch a talk at Chrome Dev Summit. I was asked to switch squoosh.app from Preact to Vercel, and was told I wasn't a team player for refusing. Mad.

I thought I knew all markdown syntax. gist.github.com/naugtur/bcd4...

pedocon theory like the theory of gravity at this point www.lgbtqnation.com/2025/09/gop-...

This only happens to you once

from the latest print edition of ‘The Onion’

ECMAScript Excitement 🎉 This week, at its 110th meeting, TC39 advanced these proposals: 3️⃣ Non-extensible applies to Private 2️⃣.7️⃣ Import Bytes 2️⃣.7️⃣ Iterator Chunking 2️⃣ Native Promise Predicate 1️⃣ Array.prototype.pushAll 1️⃣ Native Promise Adoption

People in Genoa (the city with the largest port in Italy) donated 500 tonnes of food for Gaza, but it's stuck there because... Israel only allows food to enter Gaza if it doesn't contain carbs or sugar, as otherwise it would be too nutrient (article in Italian) www.ilpost.it/2025/09/26/c...

"A new study shows that when processing political content, the brains of people with extreme views — regardless whether they identify as left or right — show more similarities than those of political centrists." www.brown.edu/news/2025-08...

Neurodivergent conditions are only disabilities because we live in a world not designed for us. Easy to imagine a flipped narrative in a world run by neurodivergents,eg “Patient insists others decode hidden meanings behind their words and compulsively makes eye contact for excessive amounts of time“

BREAKING: Starbucks just announced a $1 billion restructuring and will close 59 unionized stores — nearly 10% of union locations. It includes the Roastery in Seattle, one of its busiest shops. CEO Brian Niccol made $100 million in four months last year.

Heinlein or Rand - potato/potatoe (yes, that's a Dan Quayle reference)

⚡ UPDATE ⚡ An hour after posting, Chrome revised their estimate on shipping TC39 Stage 3 Temporal to be Chromium 144. (This is still very welcome news! 😉) chromestatus.com/feature/5668...

You can now embed any captcha from I'm Not a Robot onto your site! use it on your fintech site, b2b saas, edu platform, possibilities are endless docs: neal.fun/not-a-robot/...

Wonder how much Shopify and GitHub revenue is directly attributable to Ruby Gems (if not 100% it's close!) Pretty absurd bad faith antics through that lens.

Once a streamer got paid more than twice what i was paid in a year just to play the game I was working on and I'll never forget it.

CULT OF THE DEAD COW can neither confirm nor deny widespread media reports of the so-called President of the United States explicitly targeting cDc in his speech. The Herd Fears No Tiny-Handed and Orange Weirdass Senile Losers. Bow to the Cow, you decrepit little chumpstain, Bow to the Cow. .ooM

Will Github ever take spam detection seriously? Aka at all? They don't have even at the most basic blatant spam detection that any self-respecting email provider had 15 years ago, and now that we have AI you'd think it would be useful at least for this. Why do I have to keep doing this manually?

Package manager drama, not involving me: joel.drapper.me/p/rubygems-t...

Solarwinds are trying to patch a critical vulnerability that was introduced by a patch that had a critical vulnerability that patched another critical vulnerability that came from a patch that had a critical vulnerability meant to patch q critical vulnerability.

www.securityweek.com/solarwinds-m...

I'm rarely impressed by what my country's representatives say, especially in English, but when I am, it tends to be this guy m.youtube.com/watch?v=2fgL...

I'm starting to think understanding trigonometry is a prerequisite to understanding burnout.

Too late, Batman. Once this Tylenol floods the city's water supply, my wiki won't run out of editors ever again

Guess the environment in which this code doesn't throw

This is the first feature I requested from @socket.dev and it's here now! socket.dev/blog/introdu... Give your org specific instructions on handling warnings or link to internal docs!

ECMAScript excitement 😉 Congrats to @danr.bsky.social on advancing the Array.prototype.pushAll proposal to Stage 1 today at TC39 🎉 It lets you append many items into an existing array without running out of stack memory 👍 ❌ Risky: arr.push(...veryBigArray) ✅ Safe: arr.pushAll(veryBigArray)

ECMAScript excitement 😉 Congrats to Mark Miller on advancing the proposal for "Non-extensible applies to Private" to Stage 3 today at TC39 🎉 This breaking change means that if you seal/freeze an object, it cannot later have private fields stamped upon it ❄️

Shall we generalize? N fold productivity increase with AI produces security issues increase proportional to N^2

surprise surprise anyways, I have a magic tool you can add to your coding agents, go ahead and ask me what it is 😆

your regularly scheduled reminder not to let the triangle company host your projects

I know a fae trap when I see one

nothing says "we care about your privacy" more than sharing your data with 222 partners

@lateralcast.com how does one immediately get falling house but not plagiarism=2? 🙈

We’re in the discovery phase to #FreeJavaScript from Oracle: depositions, surveys, evidence, expert testimony. Costly, but vital to protect "JavaScript" for all. Help us put forward the strongest case possible👇 deno.com/blog/javascr...

Seeing the recent supply-chain attacks made me prioritize this item from our backlog as I wanted a quick way to know if any of my local projects have been affected. Meet the new vlt client `:host()` Query selector: blog.vlt.sh/blog/host-co... #javascript #nodejs #packages

If x.com activity is any indication, one demographic that's more interested in NPM supply chain security than JavaScript developers is the OF content creators. 🫣

Random NPM thoughts of the day: 1. The primary NPM registry should be obsoleted entirely ASAP 2. JSR does not do anywhere near as much as it should, and it's probably too late to fix. 3. A proper successor must only support "standard" JS, though temporarily accepting "strippable types" is ok rn ...

Like @zkat.tech said: "[packages] MUST NOT have install scripts". Allowing execution of random code from one of thousands of dependencies which come even for something like a code linter (what the fuck…) was a very bad idea.

I’m gathering notes on how to protect yourself and others in the npm ecosystem from postinstall attacks like the Shai-Hulud worm wending its way around at the moment. github.com/endojs/endo/...

🚨 Update: The "Shai-Hulud" supply chain attack has expanded to nearly 500 trojanized npm packages, including several from CrowdStrike, all using the same malware first seen in Tinycolor. Full details and package list: socket.dev/blog/ongoing... #NodeJS #JavaScript

Pythagorean Triple Square Day, as one man affectionately calls 9/16/25, is a day like no other this century.

🚨 Multiple CrowdStrike packages trojanized in an ongoing npm supply chain attack: This is the same campaign that hit Tinycolor yesterday with identical malware. Full list of compromised packages + mitigations → socket.dev/blog/ongoing... #NodeJS #JavaScript

“Hey why don’t you invest billions of dollars in a factory here, and every four years we’ll flip a coin and maybe a posse of mouthbreathing thugs will throw hoods over your employees’ heads and fly them to a foreign prison”

I’ve been holding back on this for a while… but Bun v1.2.22 adding its own tsconfig flag finally pushed me over the edge. 🥴 I wrote: Why using Bun in production (maybe) isn’t the best idea 👉 dev.to/wojtekmaj/wh...

Looked at my data collections for state-backed activity. If the report were a picture:

🚨 A new phishing campaign is hitting crates maintainers, pretending to be from the Rust Foundation and asking for logins. There’s no evidence crates.io is compromised but the emails are convincing and are bypassing Gmail spam filters. socket.dev/blog/crates-... #rustlang