Thomas Huber
@thomashuber.dev
Programming & Tinkering. #javascript #typescript #dotnet #deno
deno desktop is INSANELY thorough. I assumed it would be super basic but it's actually a real electron killer. Notifications, DMGs, support for bundled CEF (Electron style) and native WebView (Tauri style), Auto-updater, multi-window support, and on and on. @deno.land cooked so hard with this one.
Deno 2.8.1 is out - 33 bug fixes plus several security advisories addressed. All users are strongly encouraged to update as soon as possible. github.com/denoland/den...
Release v2.8.1 · denoland/deno
2.8.1 / 2026.05.27 Revert "fix(ext/node): polyfill module.enableCompileCache and companions" (#34190) (#34348) feat(bundle): support browser field map in package.json (#34407) fix(bundle): read pa...
github.com
Firefox now supports Web Serial on desktop 🦊 This means web apps can connect to compatible hardware devices such as microcontrollers, development boards, 3D printers, power meters, and other serial-connected hardware. Allowing the Web to do even more! 📖Read more: 🧵👇️ (1/11)
Mozilla and Adafruit bring Web Serial workflows to Firefox | The Mozilla Blog
Launching Web Serial in Firefox 151 The web is built by communities, but not all communities use the web the same way. That philosophy shaped part of
blog.mozilla.org
Deno 2.8 is released! - 6 new subcommands - defaulting to "npm:" - Node.js api compat: 42% → 74% - import defer - 3.6× faster cold npm installs - Network debugging in Chrome DevTools - TypeScript 6 - catalog: support - Cross-platform npm installs - deno install --prod
npm user? 💡 One small change to stay safe ➡️ Add these @socket.dev Firewall aliases and forget about it ➡️ npm install blocks known malware I use this: - locally, to stay safe - in my CI to detect compromised transitive deps early This completes the pnpm release cooldowns nicely
🚨 BREAKING: Socket is investigating an active npm supply chain attack compromising hundreds of packages in the @antv ecosystem. The malicious publish wave appears tied to Mini Shai-Hulud and packages connected to the npm maintainer account atool.
Deno 2.8 ships this week. Our biggest minor release ever. Node.js compatibility: 42% → 75%+ this year. 500+ Node compat commits since 2.7. TypeScript 6.0.3, `import defer` support, several new subcommands, catalog workspaces, CPU flamegraphs, and many more.
84 TanStack npm package artifacts were compromised in the ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. Details: socket.dev/blog/tanstac...
Tanstack npm Packages Compromised in Ongoing Mini Shai-Hulud...
Socket detected 84 compromised TanStack npm packages modified with suspected CI credential-stealing malware.
socket.dev
we launched a new @e18e.dev mini-site today! replacements.fyi acts as a super simple frontend to the module replacements data. we noticed the data wasn't very discoverable, so this is a focused tool for when you want to quicky look up if something has alternatives (esp. native ones!)
replacements.fyi - A new module replacements website
A look at the new module replacements website and the collaboration that went into it
e18e.dev
🚨 North Korea’s Contagious Interview campaign is now spreading across 5 ecosystems. We found coordinated malicious packages on npm, PyPI, Go Modules, Crates, and Packagist delivering staged RAT payloads that steal credentials, wallets & browser data. socket.dev/blog/contagi...
North Korea’s Contagious Interview Campaign Spreads Across 5...
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentia...
socket.dev
North Korea is targeting npm maintainers. Not for crypto. For write access to packages downloaded trillions of times a year. Lodash. Fastify. axios. mocha. Node.js core. Even @feross.bsky.social and several @socket.dev engineers! socket.dev/blog/attacke...
Attackers Are Hunting High-Impact Node.js Maintainers in a C...
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
socket.dev
"Axios npm Packages Compromised in Supply Chain Attack" 👉 thecybersecguru.com/news/axios-n... Maybe you should have less dependencies in your project and lean more on established web standards. Maybe, IDK.
Axios NPM Packages Compromised: Active Supply Chain Attack Alert | The CyberSec Guru
Axios NPM packages v1.14.1 and v0.30.4 compromised. Malicious plain-crypto-js@4.2.1 dependency injected. Full technical breakdown
thecybersecguru.com
This kind of attack is getting more and more common. Early in my career I used to update dependencies blindly — not anymore. For a few years now I’ve been locking packages to specific versions, reading changelogs carefully, and setting a `cooldown` in Dependabot (link in thread).
Socket@socket.dev · 4mo ago🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...
🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...
Supply Chain Attack on Axios Pulls Malicious Dependency from...
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHu...
socket.dev
CSS is DOOMed! I've build DOOM in CSS and every wall, floor, barrel, and imp is a div, positioned in 3D space using CSS transforms. cssdoom.wtf Try it out! But... not every browser can handle it. This is taking the browser to its limit. Chrome has some issues. Safari too. Bugs will be filed.
cssDOOM
DOOM rendered entirely in CSS. Every wall, floor, barrel, and imp is a div, positioned in 3D space using CSS transforms.
cssdoom.wtf
Remember to periodically verify that you've opted out of GitHub's Copilot data collection bullshit. I thought I had done that, but nope... 👉 github.com/settings/cop...
Build software better, together
GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.
github.com
Can't pivot to AI until after the pivot to video, so… 🤷 www.youtube.com/watch?v=RfNz... #css #webdev
The most broken-looking CSS that still works
YouTube video by Peter Kröner
youtube.com
📢 Code.Movie 0.0.40 Includes improvements for dealing with MANY obscure CSS features, heuristics improvements and support for .env syntax Blog post: code.movie/blog/improve... On NPM: www.npmjs.com/package/@cod...
TypeScript 6.0 is now available! This release brings better type-checking for methods, new standard library features, new module features for Node.js, and more! But most important, this release brings us one step closer to the upcoming native-speed 7.0! devblogs.microsoft.com/typescript/a...
Announcing TypeScript 6.0 - TypeScript
TypeScript 6.0 is now available! TypeScript 6 is a stepping-stone release, aligning with the upcoming native-speed 7.0 release.
devblogs.microsoft.com
You might have noticed me sharing a lot of posts from ex-Deno folks. I'd unhesitatingly go to bat for, work with, or hire each and every one of my now-former colleagues in a heartbeat. To a person, these are brilliant, kind, thoughtful humans who are each exceptionally excellent at what they do.
It's about time! Configure and monitor your cron tasks with Deno Deploy. docs.deno.com/deploy/cron/
Version 2.7 der Runtime für JavaScript und TypeScript stabilisiert die Temporal API, führt npm-Overrides ein und verbessert die Node.js-Kompatibilität deutlich. #JavaScript
Deno 2.7 schärft Node.js-Kompatibilität und stabilisiert Temporal
Version 2.7 der Runtime für JavaScript und TypeScript stabilisiert die Temporal API, führt npm-Overrides ein und verbessert die Node.js-Kompatibilität deutlich.
heise.de
Deno v2.7 is here! 🕛 Temporal API stabilized 🪟 Windows ARM native support ⚙️ npm overrides support 📦 deno compile --self-extracting 🩹 Node compat fixes ...and more! deno.com/blog/v2.7
If you heard: "Don't bother learning to code, AI will do it all." They're wrong. Here's why. adventures.nodeland.dev/archive/yes-...
Kann ich in Angular auf #Rxjs verzichten? Das will ich heute abend im Livestream testen. Ich hab das schon mal versucht, vor 3 Jahren, damals war das nicht möglich. Jetzt mit #angular21 sieht das ganze schon vielversprechender aus. Start ist: 20:00 webdave.tv
webdave_de - Twitch
Komm gerne zu uns in den Discord.Dort kannst du fragen stellen und Fragen beantworten.Wenn du mehr über mich wissen möchtest:https://www.webdave.de/blog/my-way-into-tech
webdave.tv
We couldn't have built our own docs generation without @deno.land tools, here to collaborate with all registries @jsr.io 🤝 @npmx.dev
Mit Deno Deploy können Developer JavaScript- und TypeScript-Anwendungen ins Web deployen. Für erhöhte Sicherheit steht die neue Deno Sandbox bereit. #JavaScript
Deno Deploy ist allgemein verfügbar
Mit Deno Deploy können Developer JavaScript- und TypeScript-Anwendungen ins Web deployen. Für erhöhte Sicherheit steht die neue Deno Sandbox bereit.
heise.de
🤓💩 Save the date: I'm going to do some more verbal webdev shitposting at WeAreDevelopers LIVE next Wednesday! 👉 www.wearedevelopers.com/en/live
WeAreDevelopers LIVE – The weekly developer show
Join us every Wednesday from 12:30 to 13:30 CEST for WeAreDevelopers LIVE! Dive into the latest in development as we discuss news, explore tools, share tips and tricks, and highlight valuable resource...
wearedevelopers.com