finding someone is so hard. hard enough that i put a $5,000 bounty. normal-people.com/bf

… are fucking kidding me. A github.com cross-account RCE due to the most pedestrian of injection attacks along the obvious exposed surface… and they actually have a globally shared “git” UNIX user!! This is not what taking the role of supply chain stewards seriously looks like.

today and always ./🏳️‍⚧️

are these Node 0.x consumers in the room with us right now?

Made a thing to compare prebuilt binary sizes. github.com/bluwy/npm-pr...

W us!

npmx is now in alpha: this is our story, as told by our team and friends

me every day this last week

Now running my own PDS, devminer.social 🚀 I should probably put a redirect on the frontpage lolz Have fun, later me

today we distributed some of our sponsors fund to a few people for their great work: - @hyeseong.kim - @webpro.nl - @devminer.xyz - @superchupu.dev - @lukeed.bsky.social thanks so much to you all for being part of the community and helping out so many of us. your work is incredibly valuable 💙

In JS there’s @e18e.dev community that does a ton of work to make the JS ecosystem faster and safer. e18e.dev/blog.html Thanks to them, your node_modules has gotten much smaller. And they recently opened up for donations. I, of course, immediately subscribed. opencollective.com/e18e

After some @11ty.dev housekeeping yesterday I’ve crossed paths with folks on the @e18e.dev team and just wanted to say they are doing very good work! e18e.dev If you’ve ever been frustrated by outdated deps or had trouble upgrading deps, these folks are solving problems before they get to you 🏆

Poof! ✨ postman-request, an HTTP client with 1.1M weekly downloads, just dropped its brotli dependency in favor of Node.js’ built-in Brotli compression. That’s 1,673.1 GB of data saved every week! 🤓 github.com/postmanlabs/... @e18e.dev

some thoughts on bundling dependencies in libraries and dev tools. especially given the great effort from the community lately, we need to bundle less and less (in consumed packages)

small announcement - we have now moved the ecosystem cleanup project into @e18e.dev to be the official issue tracker, for _all_ ecosystem issues (incl cleanup, speedup, etc) if you want to get involved in e18e, this is a good place to start!

>clicks "download as guest" >has to enter private information tfw guest != guest thanks ST

Just published the first part of my series about my homelab. This has taken roughly about 3 months to make. I hope to be able to share my knowledge with it with the rest of you :) nstlopez.com/blog/my-plan...

Working on a React project? If you’ve migrated to TypeScript, check your dependencies - many projects still include the prop-types package even though it’s no longer used. Cleaning up unused dependencies keeps your app lean and easier to maintain #webperf #e18e

Small bash function `nr` to auto use `node --run` instead of `npm run` when available (for better performance ⚡ @e18e.dev ) gist.github.com/yannbertrand...

What a great initiative! 🤩 I just learned about it because a community member raised an issue to improve Testing Library's tooling. These are the heroes the open source community needs (and makes working in this space fun) 🏆

(small behind-the-scenes effort) the @expo.dev SDK 52 will shed several old/unused npm deps in future SDKs pre-bundling, more fixes, and external changes will help too But overall, installing SDK 52 will already be faster than installing SDK 51 🚀 (npm graph side-by-side for comparison)

We're fixing Storybook bloat, one dependency at a time! 🔪 @storybookjs.bsky.social

wow, github.com still doesn't have AAAA records. *shakes fist* (noticed something failed hitting github on a VM that intentionally only has IPv6 for testing)