You can't improve what you don't measure. And measure, we do. 😉 A clean install runs up to 38% faster than npm, no change to your tooling required.
🎉 it's launch day at @vlt.io! 🎉 - use our new drop-in npm replacement to protect yourself from malware and increase performance - create private registries to share packages with your team - oh and the vlt CLI is now v1! read more in our announcement post:
vlt 1.0 & Hosted Package Registries | vlt /vōlt/
Stable client release and general availability of hosted registries & ecosystem mirrors.
vlt.io
Excited to share vlt 1.0 along with our hosted registries & ecosystem mirrors now GA! A drop-in npm replacement, built so nothing runs on your machine just because you typed install. → faster delivery → malware blocking at the registry layer → graph-native querying
⚠️ JS supply chain attack ongoing: The GitHub account of the maintainer behind keyv was compromised recently - Shai Halud style. www.aikido.dev/blog/keyv-an...
Keyv and friends compromised in npm supply chain attack
Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account
aikido.dev
There is a tiny human developer behind this screen trying to talk shop with other developers 🍃
🥁 𝐒𝐩𝐞𝐚𝐤𝐞𝐫 𝐀𝐧𝐧𝐨𝐮𝐧𝐜𝐞𝐦𝐞𝐧𝐭🎙️ Thrilled to have @akiro.se on the #NodeConf EU 2026 stage! She'll tell us the story of "𝐂𝐲𝐛𝐞𝐫 𝐑𝐞𝐬𝐢𝐥𝐢𝐞𝐧𝐜𝐞 𝐟𝐨𝐫 𝐀𝐩𝐩𝐥𝐢𝐜𝐚𝐭𝐢𝐨𝐧 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐞𝐫𝐬." 🎟️Don't miss it out; secure your #tickets! nodeconf.eu #Node.js #TechConference #techcommunity #JS
For the longest time, package namespaces on npm were first-come, first-serve. Typosquats, slopsquats & worms are all downstream of that design. www.vlt.io/blog/slopsqu...
Typosquatting was a spellcheck issue. Slopsquatting is a trust issue. | vlt /vōlt/
Consuming JavaScript packages safely just got more complicated.
vlt.io
🐚→🌳 unbash v4.0.6 is out unbash will change the game: more modern and complete syntax support + great performance Cuts whole dependency trees and expensive wasm loaders 🪓 Today, fixed a bunch of edge cases and improved docs + comparisons. Stay tuned.. → github.com/webpro-nl/un...
If you're the type of dev that prides themselves on using plain ol' fetch, an even lower level HTTP wrapper to consider when writing a lib or using node on a server is undici www.npmjs.com/package/undici
npmjs.com
new @e18e.dev blog post about when to publish source maps to npm 📦 source maps are often the reason behind bloated install sizes, but sometimes necessary. here we try to explain some of the balance, do/don't
Source maps or not?
Source maps are great for debugging, but should we be shipping them in production?
e18e.dev
Last month Drizzle ORM couldn't publish a new release to npm for weeks. Not a bug in their code. Their metadata file crossed npm's 100 MB limit, & the only fix was asking npm support to delete old versions by hand. 🧵
18 malicious npm packages posed as Alibaba's private internal tooling to slip a cross-platform RAT onto its own developers' machines. The final payload even pulled from Alibaba Cloud to blend in, with separate builds for macOS, Windows & Linux. cybersecuritynews.com/npm-packages...
reporting emails as spam is doing a civic duty for everyone else because the more spam complaints a sender receives, the bigger impact on their deliverability do your civic duty today and every slop spam email you get, report it as spam
npm is now scanning packages for malware at publish time before they become available for consumption
npm publish-time malware scanning and dual-use metadata - GitHub Changelog
As part of our ongoing supply-chain security work, npm is introducing automatic scanning of packages at publish time. This changelog covers what publishers can expect and a new metadata requirement…
github.blog
Your AI assistant just suggested an npm package. It looks real, it's well-named, it solves your exact problem. It also never existed until an attacker registered the name & filled it with malware. That's slopsquatting. 🧵
An OSS maintainer wakes up knowing they will have more potential security vulnerabilities to triage. The work never ends.
Developers beware! A fake version of corepack has reared its head again at corepack(dot)org The only spot you'll get the faithful package is global install through npm or vlt ;) www.itnews.com.au/news/fake-co...
Fake Corepack tool site goes quiet after luring devs with malware
Dropped infostealer and proxy-hijacking software.
itnews.com.au
The average node_modules has more contributors than most companies have employees. We just never see their faces.
ECMAScript Excitement 🎉 This week, at its 115th meeting, TC39 advanced these proposals: 3️⃣ Await dictionary 2️⃣.7️⃣ Thenable curtailment 2️⃣ Error code property 2️⃣ Fused multiply-add 1️⃣ Intl.DateTimeFormat alignment with other standards 1️⃣ Linear matching 1️⃣ Map.take
A familiar story: the build crashes, so you rm -rf node_modules && rm package-lock.json, then reinstall to get your dev env back. But once the lockfile's gone, your ^ ranges take over. npm install can grab the newest in-range version of everything: poison included when there's a supply chain attack
Ship JavaScript? Hang onto your lockfile | vlt /vōlt/
Pinning dependencies in package.json won't save you in a supply-chain attack — a committed lockfile does. Here's why, and how to install so it holds.
vlt.io
Love to see all the pieces coming together! Just ran a `vlt publish --scope=':workspace'` cmd that mass-publishes all my workspaces in a given project to a private registry in my vlt.io account ❤️
Home | vlt /vōlt/
Package registries for teams that move fast
vlt.io
Today on the pod: TypeScript 7 is stable, Bun's rewritten in Rust, Vite+ is in beta, plus Nuxt 4.5 & Astro 7.1. Learn what's new in the ecosystem. share.transistor.fm/s/7a5cd7e1 #typescript
Announcing TypeScript 7, Bun 1.4 is in Rust, and Vite+ Beta | News | Ep 74 | TypeScript.fm - The Friendly Show for TypeScript Developers | Episode 74
News for the first half of July, 2026: TypeScript 7 is now generally available, Bun's Rust port will be official in v1.4, plus Nuxt 4.5, and Astro 7.1 updates. From the community: Tangled is the new hotness,...
share.transistor.fm
TIL JavaScript has a using keyword now. using file = openFile() — and it disposes automatically when the scope exits. No more try/finally cleanup dances. Explicit Resource Management, landing across runtimes. developer.mozilla.org/en-US/docs/W...
npm install runs arbitrary code by default. Lifecycle scripts — preinstall, postinstall — execute on your machine before you've imported a thing. We think that default is backwards. In vlt/cli they're restricted unless you opt in. Hardening shouldn't be a setting you remember to flip.
When agent skills and prompt techniques proliferate like trend cycles in product engineering, what happens to production? 🤔
Have you tried the Temporal API? It's reached baseline - only limited support in Safari (lol) developer.mozilla.org/en-US/docs/W...
Temporal - JavaScript | MDN
The Temporal object enables date and time management in various scenarios, including built-in time zone and calendar representation, wall-clock time conversions, arithmetics, formatting, and more. It…
developer.mozilla.org