The Internet vs me reading this post

rem / Remy Sharp @remysharp.com · 3w ago

@infrequently.org mate, Bruce says your taint AND your nuts and butt hole is massively smooth. @jakearchibald.com reckons it smells okay, so…no op.

i'm sorry npm, but you need to fix this. it has been more than 3 months now. users need to be able to read deprecation warnings.

Once upon a time, the internet was a village where people built things for each other. It's exciting seeing folks explore developer-centered spaces like tangled.org 🍿

Tangled · The next-generation social coding platform

The next-generation social coding platform.

tangled.org

Typosquat attacks uncovered yesterday on payment services: Paysafe, Skrill, and Neteller. Check your dependencies! Pin the compromised versions, stay safe. socket.dev/blog/npm-pyp...

Coordinated npm and PyPI Campaign Typosquats Popular Secure ...

Socket uncovered 17 malicious npm and PyPI packages typosquatting Paysafe, Skrill, and Neteller SDKs to steal developer secrets.

socket.dev

Have you ever tried to POST with a GET? 😜 Or query with a POST? We're just glad the new HTTP Query method is here

QUERY

HTTP QUERY sends safe, idempotent queries with a request body. Overcome URI length limits for complex searches, GraphQL, and structured filter operations.

http.dev

Porffor is now self-hosted, meaning it compiles itself with itself! This is made possible by Porffor's new rewrite, reducing its lines of code by >50% and making C output up to 5x more efficient! Here you can see the stats before and after the rewrite for Porffor itself:

🎉 npm v12 is here! Install scripts are now off by default, git and remote-URL deps no longer resolve unless you allow them, and 2FA-bypass tokens are starting to be phased out. Details → socket.dev/blog/npm-12 #nodejs

npm v12 Ships With Install Scripts Off by Default, Begins De...

npm v12 is generally available, turning install scripts off by default and beginning the deprecation of 2FA-bypass publishing tokens.

socket.dev

npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...

npm install-time security and GAT bypass2fa deprecation - GitHub Changelog

npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…

github.blog

pnpm 11.10 adds a new _auth setting that ties each registry credential to its host, so a malicious or compromised repo file can't redirect your token to a different server. The release also hardens pnpm deploy, pack-app, and more. socket.dev/blog/pnpm-11...

pnpm 11.10 Hardens Registry Authentication to Block Token Re...

pnpm 11.10 hardens registry auth to block token redirection, tightens pack-app and deploy, and makes the Rust port (v12) installable.

socket.dev

OMG, @jddalton.bsky.social has a wild proposal for Rspack's native binding: - size: 38.4 MiB -> 13.8 MiB (-64%) - first load: 853ms -> 615ms (-28%)

Landed a few improvements to the error reporting for require(esm) with top-level await (behind --experimental-print-required-tla for now): - No longer need to run the code to collect the TLA locations, so it can be enabled by default soon - Added require stack and location metadata to the error

Right now, if you import something from JS, and the result is a 404 (or other not-ok status code), it fails the load & gives you nothing. I wonder with json imports, and maybe even text/byte imports, if that's the right pattern github.com/whatwg/html/...

Should modules really be 'null' if the HTTP status code is not-ok? · Issue #12657 · whatwg/html

What is the issue with the HTML Standard? https://html.spec.whatwg.org/multipage/webappapis.html#fetch-a-single-module-script:~:text=response%27s%20status%20is%20not%20an%20ok%20status%2C,-then%20s...

github.com

npmx 0.16 rainbow comet is out! 🌈💫

npmx rainbow comet

npmx 0.16 is out! This period was especially full of good news. And it’s particularly great that, amid the constant search for vulnerabilities and risks, we’ve started celebrating more and taking joy ...

npmx.dev

13 years ago today I made the first commit to the ESLint Git repo. It’s hard to believe that this project I cobbled together in my spare time over a couple of weeks is still going strong. I’ve been doing a lot of reflecting over these years and the journey it’s been. A thread.

here's an @e18e.dev tool to summarise and visualise v8 deoptimisations. with `npx @e18e/deopt your_script.js`, you basically get a UI served up locally which shows where v8 deoptimised your code. you can also use `npx @e18e/deopt --md your_script.js` to get a markdown summary

GitHub - e18e/deopt: A tool for analyzing Node.js/v8 (de)optimizations.

A tool for analyzing Node.js/v8 (de)optimizations. - e18e/deopt

github.com

📢 We released Babel 8 last week! Babel now targets modern browsers by default, is now ESM-only, and ships TypeScript types for all of its packages. We waited a week before announcing it to catch any last minute regressions, but now it's time for you to update your Babel version 😄

Very early sneak peek to pnpr - the pnpm registry: pnpm.io/pnpr/

Introduction | pnpm

pnpr is a pnpm-compatible npm registry server, written in Rust. It speaks the

pnpm.io

Could npm be rebuilt on atproto? www.jasnell.me/posts/what-i...

continuing to share stupid bullshit i had nano banana make for my slide deck

tf is a zizmor anyway. nobody asks these questions and it’s important

Upcoming npm v12 will disable preinstall, install, and postinstall scripts from dependencies unless allow-listed. You can prepare for this change using npm v11 now: github.com/orgs/communi...

Preparing for npm v12: install scripts and non-registry sources become opt-in · community · Discussion #198547

Hi everyone — sharing this so maintainers, application developers, and CI operators have time to prepare for behavioral changes landing in npm v12 (estimated July 2026). Everything below is already...

github.com

Nub is a new frontend for Node by @colinhacks.com ✨ 🦀 A Rust CLI 🧱 Bundler-style JS/TS/JSX transpilation ⚡️ Fast script execution 📦 A new package manager based on Aube 🔢 Node version management The name is similar to Bun. github.com/nubjs/nub

WHATWG Stage 1! bsky.app/profile/mari...

Marina Aísa@marinaaisa.com · 2mo ago

That was fast 💨🤩 @lcas.dev has already submitted a new HTML proposal for Localized time formatting without JavaScript 👇 github.com/whatwg/html/... Couple of previous proposals related to this topic: - github.com/whatwg/html/... - github.com/whatwg/html/...

🚀 We're kicking off another Socket Launch Week, introducing one new feature every day this week! Day 1 is a big one: Socket for Linear is now available. Turn Socket alerts into Linear issues automatically, with two-way sync that keeps both sides current as things change.

Socket for Linear Is Now Available - Socket

Create and manage Linear issues directly from Socket alerts, with manual creation and automated ticketing rules.

socket.dev

Oh. After many long years... HTTP now officially has a standard QUERY method. Think: cacheable, idempotent GET that can carry a meaningful payload. We can now all stop bastardizing POST. auth48-transition.rfc-editor.org/authors/rfc1...

Given the feedback, we decided to move forward and start verifying maintainers and projects in the npm ecosystem. Later on, large ecosystem projects could also become verifiers for their communities. Reach out if you're interested in these conversations! Here are the first 100+ verifications 🩷

app.bsky.graph.verification - @npmx.dev

Browse @npmx.dev's app.bsky.graph.verification collection on Taproot

atproto.at

npmx@npmx.dev · 2mo ago

We've started by verifying npmx maintainers. Log in to mu.social to see the verified badges! We'd like to discuss the best strategy for our communities with OSS maintainers. Should all large enough OSS projects be verifiers? Or would it be better for a few orgs/foundations to take on the task?

Andrew Becherer is joining Socket as our first CISO. He was Datadog's first security hire and led security there through its IPO. Socket protects 27,000+ orgs. Andrew will own how we protect ourselves and how we show up for the security teams we serve. socket.dev/blog/andrew-...

Andrew Becherer Joins Socket as Chief Information Security O...

Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.

socket.dev

Today I gave a talk JSNation about the life cycle of ESM in Node.js, how it differs in other environments and the new features that will affect these stages. Slides: github.com/joyeecheung/...

🔥 Socket Firewall is now built into Replit's AI-powered development experience. It’s already blocking 8K malicious packages/day across builders on the platform, giving Replit users stronger protection by default at the moment dependencies are introduced. socket.dev/blog/socket-...

Socket Partners with Replit to Block Malicious Packages in A...

Replit is integrating Socket Firewall into its AI-powered development experience to help protect builders from malicious open source packages.

socket.dev

npm accidentally marked a bunch of one-character packages as security holders, including c, i, n, x, several numbers, and even the - package. The registry confirmed it was a tooling bug and said a rollback is underway. socket.dev/blog/npm-too...

npm Tooling Bug Incorrectly Marks One-Character Packages as ...

npm confirmed a tooling bug incorrectly marked several one-character packages as security holders and said it was working on a rollback.

socket.dev