🎟️ NodeConf EU 2026 is in Bologna in 3 weeks, and tickets are running low. Sep 29-30. The Savoia Regency, an 18th-century villa set in a 10,000m² park, 5km from the city center. Pool between sessions, Emilia-Romagna food, and two days of real Node.js depth.

Ok, fine, yes, I didn't realize how much I missed going to geeky meetups (it's a luxury for me these days, with family and other commitments). Had a great time yesterday, @naugtur.pl @notwes.bsky.social! See you in Vilnius sometime?

Ohai, Warsaw! You've grown 😱

Two dudes, one talk: Warsaw on September 3rd where @naugtur.pl and I will be (very professionally, I swear) talking about supply chain security at @meetjs.bsky.social.

An incredible experience. Worth the travel, the money, the heat, even if it only lasted 90s.

I triage 20-40 security vulnerability reports a week. Almost all of them are now AI-written. And we usually get 3-5 duplicates of each one. That's the new reality of being a maintainer. 🧵

Make sure you download the literature from that lady's archive. What a nice lady she is, Anna. Check if the author has a Patreon or smth like that too.

taylor.town@taylor.town · 4w ago

inference

I'm watching this, and sure sure the agents coordinating is neat, but once again, WHY ARE WE CHILL WITH Artifactory HAVING SEVERAL RCEs, SSRFs, and unauthorized writes. Why are we chill with Hugging Face having RCEs. Why are we chill with GitHub having RCEs (unrelated, from April).

Ethan Mollick@emollick.bsky.social · last mo.

You may have been told to watch this video about the OpenAI AI hack. You really should, even if you don't usually care about any tech stuff. If nothing else, click this link to the 18 minutes in & see how the agents spoke & coordinated with each other. Its eye opening. youtu.be/87DyyMV0kCY?...

This bothers me. Nx v1 was released in 2018, yet nx.dev/blog/cve-202... (CREEP) was only discovered in 2025 (and is, disingenuously, described as a "race condition", which it is not - it's just inappropriate use of shared resources without trust boundaries).

CVE-2025-36852: Critical Cache Poisoning Vulnerability Affects Multiple Build Systems | Nx Blog

A critical security vulnerability called CREEP (Cache Race-condition Exploit Enables Poisoning) has been published as CVE-2025-36852. This vulnerability affects remote cache plugins across numerous bu...

nx.dev

Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying

What do you all think of NPM adding scanning of all packages during publish- a 15-minute delay during peak times? What concerns me the most is: 1. false positives 2. the SLA for the "appeal process" Anyway, good step! github.blog/changelog/20...

npm publish-time malware scanning and dual-use metadata - GitHub Changelog

As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…

github.blog

Yet another example of how Github is hopelessly unprepared for the agentic world: github.blog/changelog/20...

Read-only Actions cache for untrusted triggers - GitHub Changelog

GitHub Actions now issues read-only cache tokens to the default branch for workflow events that can be triggered without write permissions to the repository. This applies least privilege to the…

github.blog

The more I dig into tightening up our Github permissions, the more I: - want to punch someone - ask where a friend of mine could buy a flamethrower - understand why Github is in the state that it is in terms of supply chain attacks.

Hidden in the release notes for npm@12: > The default license for npm init has been changed from "ISC" to an empty string. If not set, the license field will be omitted from new packages. Which means a bunch of new packages will be unlicensed, which also means you can't use them in your projects 🎉

Node.js runs under almost every AI product shipping today. The least the industry can do is give its maintainers the tools to keep it secure. Live July 15 👇 streamyard.com/watch/YJ7W3s...

This article has only one important phrase - something along the lines of "if sanctions don't ease up and you don't let us pillage Ukraine - russia might use nukes". Which is literally the same PR campaign that's been going the past 3-4 weeks where nukes just get mentioned casually by russians.

Jakub Jaraczewski@jakubjaraczewski.bsky.social · 2mo ago

🇷🇺 @economist.com gives voice to the poor people who suffer, such as a sanctioned Russian oligarch who parrots the usual Kremlin talking points: Russia is inevitable, a wealthy Russia is a wealthy West, a stable (imperial) Russia is better for everyone, etc. etc.

1996 Novice: I made the forms work 1996 Webbies: fucking copied that from a forum 2006 Novice: I made it interactive 2006 Webbies: you fucking stackoverflow script kiddie 2016 Novice: I made a nice website 2016 Webbies: ugh, fucking bootstrap? 2026 Novice: I made a thing 2026 Webbies: WTF it AI slop

I know I could log in and unsubscribe or add a filter, but I want to go viral with shaming this bullshit.

I sometimes have so much stress at work that I want to do some work at work to relax.

I do catch myself thinking "did I use to talk like this before AI?" several times every week...

Gergely Orosz@gergely.pragmaticengineer.com · 2mo ago

Let me know if this is just me: Noticed someone I know who is very "AI-pilled" and uses agents 24/7 to... start to talk IRL noticeably more like these LLMs write. Eg more heavily using adjectives like "geniune", frequently terms like "the shape of" and many more examples

"ai" "agents" don't exist. I have a massive problem (it's a me problem...) with "have an agent do it". All the "doing" happens by the harness (it's making API calls to LLMs and tools and composes the results).

What are the companies building multiplayer experiences on top of agents/llms?

Ive been hearing claims of JSON handling being a decent chunk of compute so much I'm thinking we should get a hardware module for that already 🤣

A drinking game where you drink when Claude says "load-bearing" would be super dangerous.

Mikio Braun 💎@mikiobraun.com · 3mo ago

I'd really like to know where Opus 4.7 and 4.8 got these verbal tics from. It constantly says stuff like "load-bearing" (instead of just saying it's important), or "X-shaped" instead of "looks like X". Do people really talk like this somewhere (I'm assuming in Silicon Valley?)

#NodeConf EU is back! If you've been working on something worth sharing about #Node.js internals, performance, #developer experience, or anything in between, this is the stage for you! nodeconf.eu See you in Bologna! 🇮🇹

I don't know how this little story from, supposedly, 2009 ended up in my Instapaper. Maybe it's a virus. I had fun reading it. www.teamten.com/lawrence/wri...

Is there an existing way to do a coverage report per-test? To start with - in any language? As in, I click on a test and it immediately shows me which lines are covered by it specifically (and lines which are only covered by that test, and if there are no such lines - some overlap analysis or smth)?

It's 2026. Markdown is executable. It's prone to injections. It can do eval().

Staring at 28 High SAST findings for "Disclosure of Error Details and Stack Traces". I mean, if I have to go and ask the teams to justify and fill out a form for every use of `console.error(err)`, then maybe the AI can just go and take my job already.