I made something new: an eslint plugin to validate your npm ecosystem lockfiles! It supports npm, pnpm, yarn, bun, and vlt, and it's already helped find a supply chain security attack vector inside a fortune 500 tech company. www.npmjs.com/package/esli...

ran into my first webpage using developer.mozilla.org/en-US/docs/W... today, and i do NOT like it

having to `npm login` for the first time in a decade, and then promptly 2FA *again* to publish, is immediately very annoying, multiple times a day :-(

wow, literally never seen the "settle down, buddy" page before on @github.com guess it's time to take a break

“You shouldn’t care if JavaScript builtins are modified, just let things break when someone does dumb things!” enter react2shell.com

It is beyond frustrating to be in a position to see this coming, trying to do the work to make folks aware of it, and then also to be on the incident response to the impact of it happening again. Y'all I am tired.

ECMAScript excitement 😉 Congrats to @bridgear.bsky.social @jordan.har.band on advancing Object.keysLength to Stage 2 at TC39 today 🎉 let count = Object.keysLength(o) It counts the string-keyed own properties on an object. This avoids the cost of the intermediate array in Object.keys(o).length

Guess where the elevator is? The intentionally functional and elegant design of things i find in Japan is always impressive.

With npm supply chain attacks on the rise, secure publishing practices are becoming a pressing concern for anyone maintaining npm packages. ⚠️ We've released updated guidance to help maintainers reduce exposure, strengthen release processes, and protect the ecosystem: openjsf.org/blog/publish...

My welcome to Kyoto meal, and the resident kitty’s too

welcome to bluesky. if the word "mapquest" means anything to you and/or you used it as a verb, you're in the right place

Guide: what body part does that look like? Group, collectively: … um Guide: Buddha’s finger! Group, guiltily: ahhhhhh, yes (Hang Sửng Sốt / Surprising Cave, Ha Long Bay, Vietnam) (the surprise is the size of the 2nd and 3rd caverns, you pervs)

My first advice to junior contributors is to STOP using vibe coding for PRs. OSS is always about people more than about code. We don't need more code generated by LLM, we need more people who care.

God, just once I wish someone would remember the second half of that idiom about bad apples

Excited to announce I've joined @socket.dev as an Open Source Architect :-)

OH at @github.com Universe day 0, in a session on “beyond the bus factor”, discussing accidental leadership: “you didn’t choose the maintainer life…”

I left @hero.dev earlier this month. It's a wonderful thing to be able to truthfully say it's the best job I've ever had (not even the first time I've gotten to say that!). I love the entire team & the culture… leaving is bittersweet. I'll announce my new gig in a week or three.

The future of Lodash fosstodon.org/@ulisesgascon blog.ulisesgascon.com/the-future-o... #ECMAScript #JavaScript

Lodash still runs half the web and now it’s getting the love it deserves. 🥹 ICYMI: Thanks to investment from the @sovereign.tech, Lodash is moving into community governance and long-term sustainability. Read up: 🧠 blog.ulisesgascon.com/the-future-o... 🏛️ openjsf.org/blog/sta-inv...

This is correct. It’s VCs who spend their time doing drugs and inventing weird religions, executives who have boners about firing workers, and non-technical hucksters who are pushing this stuff. The vast majority of people doing actual technical work on the ground feel the way this piece describes

i’m starting to get that “this word is weird now” feeling from hearing so many sentences like “releasers releasing releases” at the @nodejs.org collab summit

PSA: if you’re giving a talk with a terminal or code demo, use light mode (or at least high contrast mode) so we can all see it :-)

the funniest thing about this is that those of us who grew up in the divide all have a bunch of pre-cell phone numbers memorized and almost none afterwards I know the home phone numbers of two of my childhood best friends from thirty years ago and none of the cell numbers of my college friends

Don’t worry, this is going to involve dropping lots of no-longer-needed APIs :-D

Lodash is entering a new chapter 📖 With investment from @sovereign.tech the project is getting key updates for security, modernization, and community-led governance. Details: hubs.la/Q03NrdfR0

⚡️ All set up for #JSConf ! Stop by to talk with the @vlt.sh team if you’re around!

😅👀💦

to everyone asking foss maintainers to finally publish a new version: as a teenager, have you ever been asked by someone to clean your room after you decided to do it yourself? 😇

Why are @github.com tokens allowed to have no expiry but @npmjs.bsky.social are about to make every IT team's lives a living hell? This is just more security theatre. Think harder @microsoft.com.

A cruel irony of coding agents is that everyone who blew off automated testing for the past 20 years is now telling the AI to do TDD all the time. But because LLMs were trained on decades of their shitty tests, the agents are also terrible at testing.

> It is 2025 BC. I am a soldier from one of the outlying provinces called to defend the pyramid in Memphis > It is 2025 AD. I am a soldier from one of the outlying provinces called to defend the pyramid in Memphis

As economic growth continues to falter, the civic council of Omelas debates adding a third child

i wish there was a socially acceptable, polite way to let an old person know they’ve drastically overused their perfume/cologne.

IBM has chosen HeroDevs to secure enterprises running on EOL frameworks like Spring & Struts. Now IBM customers can run legacy apps securely, with drop-in fixes + compliance coverage—modernizing on their terms. Learn more: www.herodevs.com/blog-posts/w... #IBM #HeroDevs #EOL #Cybersecurity

The maintainer of one of our dependencies, debug, was the target of a phishing attack resulting in the release of [email protected] with malware. Supply chain security is all of our responsibilities. Be careful out there, and for today don't update your deps. socket.dev/blog/npm-aut...

The Register wrote a story about a single maintainer open source project, I think it's shameful and upsetting So I wrote a blog post about it An absolutely ridiculous amount of open source is one person projects. I have the data to prove it opensourcesecurity.io/2025/08-oss-...

can't believe i only just encountered this article today www.redhat.com/en/blog/dont... "Don't Lick the Cookie!", for example, don't assign issues in open source :-)

🦈 my 6 year old’s “shark teeth”

postit found at our team offsite

Big news: HeroDevs just raised $125M from PSG + Album 🎉 We’re doubling down on Never-Ending Support for EOL OSS. ✅ Securing deprecated frameworks ✅ $20M OSS Sustainability Fund now open Let’s secure the future of open source. #OSS #DevSecOps #CyberSecurity #EOL #HeroDevs

🚨 Attackers have hijacked the npm 'is' package (~2.8M weekly downloads), adding a malicious JS loader. This compromise is linked to the recent npm phishing campaign. Read our update on this ongoing supply chain attack: socket.dev/blog/npm-is-... #NodeJS #JavaScript

oh hey look, it’s the actual solution for the thing that provenance will always fail to achieve that I’ve been telling folks to do for years and getting scoffed at security.googleblog.com/2025/07/intr...

I want to reiterate my deeply held belief. One of the biggest mistakes we are making with this tech is anthropomorphizing it and treating it like it is actually "reasoning". It's not doing that. And it cannot be held accountable. It's a machine.

Heads up that v3.3.1 of npmjs.com/is has malware in it, due to another maintainer’s account being hijacked. They’re removed for now, v3.3.0 is set at latest, v3.3.1 is deprecated, and a v3.3.2 will be published once I’m not on my phone (thx @github.com codespaces)

Harborist has published a new CVE: www.cve.org/cverecord?id... This is on all versions of the npmjs.com/form-data package, on all node versions. Please note: node 18+ and all modern browsers (caniuse.com?search=formd...) have FormData built in - please consider migrating to it!

I made a quiz about the JS Date parser is. It's very easy and you will score very high. jsdate.wtf

wrote about the bureaucractic banality of andor because I needed to understand what really appealed to me about the stories. blog.ronbronson.com/the-bureaucr...

One thing that I notice is that books and games that use AI text keep getting caught out because they cut and pasted the text and didn't remove the prompts or replies. Which suggests that using AI goes hand in hand with a general "fuck it, that'll do" lack of attention to detail throughout.