TanStack npm Supply Chain Attack: What Happened and How to Protect Your Projects
TanStack packages were compromised in a mass npm supply chain attack. Here's a deep-dive into what happened, how the attack worked, and the concrete steps every JavaScript developer must take to protect their projects right now.
Minimum Release Age: npm, pnpm, Yarn, Bun and Deno Settings
Fix npm's “min-release-age is not a valid npm option” error, then set the same cooldown in pnpm, Yarn, Bun and Deno: copy-paste config, units and versions.
npm RFC: Making Install Scripts Opt-In — A Deep Dive into What It Means for JavaScript Security
A landmark npm RFC proposes making install scripts opt-in by default. This deep-dive covers how the current system works, why it's dangerous, what the RFC proposes, the tradeoffs involved, and how you can protect yourself right now.
Proper Tail Calls in JavaScript: Why Only Safari Supports Them
Proper tail calls (ES2015) only work in Safari and Bun, which run on JavaScriptCore. Chrome, Node.js, Deno and Firefox never shipped them. Support table and fixes.
BlueJS: Compiling JavaScript to 1.2MB Native Binaries Without V8
BlueJS is a groundbreaking new compiler that turns JavaScript into tiny native binaries without bundling V8. We explore how it works, what it's good for, and where it fits in the future of JavaScript deployment.
