lol why would Glendale Community College have any info about me whatsoever??? I've never attended, applied, lived near it, or been to Glendale. this is the most confusing @haveibeenpwned.com email i've gotten yet
Jordan Harband
@jordan.har.band
https://github.com/ljharb software engineer/nerd/teacher/will try anything once; surgeon with git rebase. @TC39.es @Socket.dev ex @Coinbase/@Airbnb/@Twitter/@MobBase. Fav punctuation ⸮, scent petrichor
npm v12 is now generally available. npm install now makes install scripts, Git, and remote-URL dependencies opt-in by default. We're also retiring npm 2FA-bypass GAT: no account management (early Aug 2026), no direct publishing (~Jan 2027). More info at github.blog/changelog/20...
npm install-time security and GAT bypass2fa deprecation - GitHub Changelog
npm v12 is now generally available and tagged latest. This major release turns on the install-time security defaults we announced in June, and it’s also where we begin a deprecation…
github.blog
You shouldn’t trust Trusted Publishing https://blog.yossarian.net/2026/07/07/You-shouldnt-trust-trusted-publishing #python #security #oss
can someone please tell *every bank* that if a "secure messaging system" goes to my email address, then it's basically not possible for it to be more secure than my email account itself?
I got really tired of having to manually track down whether a package ships its own types, or has a DefinitelyTyped package, or how that changes over time. so, I made npmjs.com/dt-clean - `npx dt-clean -u` and you'll have the right version of the right DT packages!
npmjs.com
ok i know i'm a couple months late, but wtaf is this new "Marathon" game? it seems like it has precisely nothing to do with actual Marathon lore, and is just a (potentially fun but) entirely unrelated game with the title slapped on top.
it is oddly satisfying watching ferrier content on the reels
nvm.sh v0.40.5 is out, with some CVE fixes: github.com/nvm-sh/nvm/r... Be sure to update!
Release v0.40.5 · nvm-sh/nvm
New Stuff nvm install --offline: install from cache without network access Bug Fixes nvm_download_artifact: reject version strings with disallowed characters nvm_get_checksum: pass the tarball n...
github.com
oh no, i don't use the ai for <thing that i am paid to do> it's terrible at that. it's great for <thing you are paid to do> though.
Today is a big day for @socket.dev. We raised a $60M Series C at a $1B valuation, led by Thrive Capital. 20,000+ orgs, 1.5M repos protected, 1,000+ supply chain attacks blocked per week. 3/5 FAANG companies are customers. We're just getting started.
Clutching pearls about how many PURLs are in your application is just FUD and nonsense. The only thing that matters is, how many humans can put code into it. (ie all your engineers + every linux dev + every OSS maintainer etc)
PSA: add `export GH_TELEMETRY=false` and `export DO_NOT_TRACK=true` to your shell profile files to opt out of @github.com's on-by-default `gh` telemetry.
oof, who do i complain to about the name of git 2.54's "history" command? git does not have a history, it has a changelog, and the conceptual difference is very important for having the proper mental model :-(
I was pretty happy with my surroundings while discussing supply chain security today.
The thing people may not realize is that the best way to secure the supply chain is to secure the maintainers. And the best way to secure the maintainers is to pay them and give them a laptop, health insurance, and maybe even a desk to sit at.
so what i am learning from github.com/axios/axios/... is that you should simply never join a Microsoft Teams call for any reason --- because of security
Post Mortem: axios npm supply chain compromise · Issue #10636 · axios/axios
Post Mortem: axios npm supply chain compromise Date: March 31, 2026 Author: Jason Saayman Status: Remediation in progress On March 31, 2026, two malicious versions of axios (1.14.1 and 0.30.4) were...
github.com
🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week. socket.dev/blog/attacke...
Attackers Are Hunting High-Impact Node.js Maintainers in a C...
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
socket.dev
tldr; if you used @vlt.sh as your package manager, then you were protected the minute @socket.dev flagged the malicious packages in the `axios` attack yesterday. The best time to switch your package manager was 48hrs ago, the next best time is right now. More below: blog.vlt.sh/blog/vlt-build
Introducing Phased Package Installations
When you run vlt install, packages are downloaded and extracted to node_modules, but no lifecycle scripts execute.
blog.vlt.sh
Socket@socket.dev · 4mo ago🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript
🧨 Axios only needed to be resolved somewhere in your dependency graph to affect you. Semver + transitive deps + runtime installs = hidden blast radius. If you only checked your project’s lockfile, you may still not know. socket.dev/blog/hidden-... #nodejs #javascript
The Hidden Blast Radius of the Axios Compromise - Socket
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
socket.dev
ECMAScript Euphoria! 🎉 We don't always post when a single proposal advances, but when we do, it's Temporal -> Stage 4. Just days shy of 9 years from Stage 1, a herculean effort on the part of many champions, delegates, invited experts, and contributors, past and present. Thank you all! 🙌
ECMAScript excitement 😉 Congrats to @jordan.har.band on advancing Error.prototype.stack to Stage 2.7 at TC39 today 🎉 This proposal seeks to standardize the existence of the accessor in the JS spec. github.com/tc39/proposa...
Path to Stage 4! · Issue #9 · tc39/proposal-error-stack-accessor
Stage 4 committee approval two implementations v8 (node / Chrome) node (for DOMException) spidermonkey (Firefox) jsc (Webkit / Safari) Deno (for DOMException) Porffor es-shims polyfill keisel Boa s...
github.com
did you know claude code has _weekly_ usage limits? i didn't
Finally found a plane with a device holder that can fit an iPad Pro
i hadn’t hit Claude’s limits once since upgrading to the 10x max plan, but it took me less than 24 hours to hit the limits on the free open source 20x max plan (－‸ლ)
a cartoon character is sitting in front of an orange emergency exit sign
ALT: a cartoon character is sitting in front of an orange emergency exit sign
media.tenor.com
minimatch patched 3 high-severity ReDoS vulnerabilities that can stall the Node.js event loop. Because it's pulled into nearly every corner of the #NodeJS ecosystem (~472M weekly downloads), we're releasing free Certified Patches for all three. socket.dev/blog/minimat... #JavaScript
minimatch Patches 3 High-Severity ReDoS Vulnerabilities - So...
minimatch patched three high-severity ReDoS vulnerabilities that can stall the Node.js event loop, and Socket has released free certified patches.
socket.dev