100 days of ./ npmx

new release of @e18e.dev ESLint plugin (also works with oxlint!) big thanks to @webpro.nl on this one. new rules and improvements for everyone 🎉

most of these github actions driven breaches are because of pull_request_target. here's some tips of what to look for when reviewing your own workflows. worth noting - it is safe, and necessary, when used correctly 🧵

New feature on @npmx.dev 🎉 The timeline tab now comes with a chart, so it is easier to see the evolution of the package size and its dependencies. The positive and warning events queried from @e18e.dev are great to check the package health ❤️

Switched @badrap/valita to ESM-only, pretty cool how @npmx.dev celebrates the package size reduction 🎉 npmx.dev/package/@bad...

sponsored both @dreyfus11.bsky.social and @yanthomas.dev tonight—two humans who i greatly admire! thanks for all you do for the communities you're involved in and for inspiring me to keep building in the open. 💜

Show this kind of info is so nice @npmx.dev surprised me with this, hats off 👏🎉

Neat, @maplibre.org JS v6 (alpha) is going all-in on ESM-only, ES2022 for TypeScript, and @rolldown.rs for bundling 🔥 github.com/maplibre/map...

New release of the @e18e.dev ESLint plugin! 🎉 Bunch of fixes to the auto-fixes of rules, and started the process of moving merging eslint-plugin-depend into it

Want to get involved with @e18e.dev and unsure where to start? Our Framework tracker project is developing a comparison tool for meta-frameworks. We have a great list of good first issues to get stuck into. github.com/e18e/framewo...

Been mentioning it here and there but officially launching pracht, a framework-y solution for preact! www.producthunt.com/products/pra...

this is today! come hang out and see us joke about Alex getting Jake's name wrong 😂 i'll also be dropping by to share what's new in e18e lately

we launched a new @e18e.dev mini-site today! replacements.fyi acts as a super simple frontend to the module replacements data. we noticed the data wasn't very discoverable, so this is a focused tool for when you want to quicky look up if something has alternatives (esp. native ones!)

Edge's experience is similar, and the benefits accumulate all through the stack. Moving to WC from React delivers more than 40% faster LCP at P75 for us, but also dramatically better memory use and interactivity all the way down the device performance curve.

✂️ just in case anyone's interested in my take on fallow.. it's certainly not a drop-in replacement: you get a whole lot more false positives much faster 🤡 seriously though, give it some time, it'll catch up 🍅 1/3

i noticed in @npmx.dev we have a lot of warning-level notices but few "success" notices so far - so i've added a celebration message for when a package gets smaller! (coming in the next release) 🎉

we're working on a new mini-site for making replacements (native and opinionated) more discoverable in @e18e.dev already finding this useful myself anytime i want to know "do i need this anymore?" 😀 there's been such good community collab going on to build this too. loving it! 💙

this morning there was chatter in the @e18e.dev discord about i18next having unused deps/bundles this evening there's a new release out! now it is zero-dependency, and ~330KB smaller 🎉

npm packages people installed by mistake: - aws-lambda, 1.1M/w, actually an unofficial CLI for deploying lambdas - util, 39M/w, browser port of node:util, but at least 14M of those dls don't import it - https, 3.4M/w, empty package (for now?)

On ./npmx you can now compare up to 10 packages and visualise them with a scatter chart, mapping any facet to each axis to help making informed decisions in a flash. This example: npmx.dev/compare?pack...

✂️ Knip v6.6.0 is out A few neat feats and another 8 dependencies removed. Along with v6.5.0 introducing tinyglobby, this tidy graph wouldn't have happened without the @e18e.dev community ❤️ Changelog: github.com/webpro-nl/kn... Knip: knip.dev

I want to give a massive thank you to both @antfu.me and @e18e.dev for sponsoring me 💙 I will now do the most financially responsible thing I can think of, and pop out to buy a laminator 🫡

published parse5 v8.0.1 🎉 this drops the install size from 877KB to 573KB

Less than two weeks until the next e18e & friends episode is up! Time to talk about the @typescriptlang.org impact on ecosystem performance! Looking forward to the conversation with @jakebailey.dev 🙌🏻 Any questions for him? Drop them down below!

If you have any questions for Jake or Alex, let us know here or on discord! We will be answering a few of them on the stream

Next episode of e18e & friends, we will be talking to @jakebailey.dev ! Come join us on April 28th at 1PM EST / 7PM CET 🎉

we're having a little npmx social tonight in London! come join us for conversation, food, beer, and stickers 🥳 guild.host/events/npmx-...

Features everyone should steal from @npmx.dev nesbitt.io/2026/04/16/f...

An internal team just adopted tsgo (soon TypeScript 7) and told us they were able to shave off about 400 hours a month of waiting on CI builds. npmx.dev/package/@typ...

not enough packages are marked as deprecated 👀 the worst ones are readme-deprecations (readme says "DEPRECATED" but package isn't marked as such)

reading through a JS bundle is often eye opening. in a project that is built only for node: - readable-stream (built into all node LTS) - safe-buffer (Buffer.from built in since Node 5.x) - lodash - process (literally exports `globalThis.process` in node) - mkdirp (built into node) etc. etc

new release of the @e18e.dev dependency diff action! 🚀 1.5.0 lets you report bundle size changes regardless of +/- and gives you a way to run the workflow without pr target

npmx 0.8 introduces experimental quadrant graphs: scatter plot of selected packages, traction on the x-axis (downloads, freshness, likes) and developer ergonomics on the y-axis (install size, dependencies, vulnerabilities, type support). Let's know how it works for you and how we could improve it 👋

😊

coming soon 🎉 module replacements v3 has been a chunky piece of work inside @e18e.dev . it updates our data set to define individual replacements and their min engine versions. this means we can show much richer messaging like this example in npmx

"Your repository has dependencies with security vulnerabilities" at this point, its pretty much all known repos 😅

1M downloads, crazy! Was really a good idea to collab on this with @43081j.com for @e18e.dev

Update: reduced @rspack/dev-server deps from 193 → 8, install size from 14.9 MB → 4.1 MB. npm supply chain attacks keep happening and keeping deps minimal makes me feel safer.

We're working on vite-plugin-pwa v2 version: - 🦾 workbox fork: from 340+ to just 20 dependencies ( @e18e.dev ) 🤯 - ⚡ @vite.dev 8 + Environment API support (v1 works with Vite 8) - 🔌 pwa plugin becomes modular, we don't need to hack integrations anymore (ala npmx.dev/package/serw... )

Props to @t3.gg for contributing $5K to @e18e.dev! Looking forward to seeing all the creative ways @npmx.dev can collaborate with @e18e.dev to make the web faster, leaner, and simpler. We already have a bunch of things in the works 👀.

Good to see my blog post being enjoyed 😄

My 2 favorite features are replacement suggestions provided by @e18e.dev and warning about using dependencies that have Node.js requirement higher than yours

This is my contribution to @atmosphereconf.org @npmx.dev @svelte.dev @sveltesociety.dev @mullvad.bsky.social @e18e.dev

Almost there with the new module replacements dataset. Most replacements have engine info, descriptions, examples, etc. We also now map multiple options so we can choose the best one for your target engine

the cli is going boom 👀

a thing i didn't mention on here as its a touchy subject, but i'd love to know one day - the great mystery of financial incentive to have this "atomic architecture" 1/3

new version of the @e18e.dev eslint plugin! this adds type-enhancement to a few rules so they become smarter if you have TSESLint setup

we now have issue templates in module replacements :D big thanks to @stephansama.info

new post on my personal blog. i think these three areas often go unexplained, so hopefully this explains why some of these packages exist. these are fine to exist but the majority of developers shouldn't have to pay the cost for them.

They're here!! Huge huge thanks to diginate.com for sponsoring these stickers, and to @z-space.ca for letting me ship them there!!