Thomas Huber

The preliminary report related to the October 21st Security Incident is now available. blog.railway.com/p/preliminar...

🚨 LiteLLM, a Python package for connecting to AI model providers with 92M+ monthly downloads, has been compromised. Version 1.107.0 ships credential-stealing malware through PyPI wheels and Docker images, targeting cloud credentials, developer secrets, and AI tools.

Deno spent years persuading developers to bet on a better runtime. Now its creator calls gains over Node.js “marginal” and says it was “sucked into the gravity well of node compatibility.” The backlash, the forks, and how AI is changing the future of JavaScript runtimes. socket.dev/blog/deno-ac...

Leo Kettmeir von Deno zeigt, wie Deno Desktop Webseiten ohne Codeänderung in Desktop-Apps verwandelt und was es von Electron und Tauri unterscheidet. #Softwareentwicklung

Planning my migration away from Deno CLI to other, decisions to be made: - Runtime local - Runtime remote - Edge Runtime - Package manager - Local persistence - Formatter - Linter - Test harness - Code coverage - LSP - Typescript support - Scheduled jobs - OTEL I really forgot how good I had it.

Can you be sad/happy? The two years I worked at Deno and the years from Ry's early vision for Deno are behind us, but seeing Ry, Bert and the rest of the team find a home at Cloudflare is a decent outcome. deno.com/blog/cloudfl...

Deno 2.9.7 is out 🦕 - Faster `node:buffer` encoding and decoding - Improved startup time and baseline memory usage - Better pnpm lockfile handling - Several permission hardening improvements Overall 37 changes with 4 perf wins github.com/denoland/den...

Deno v2.9.6 is out! 🦕 - Clipboard API support and richer native menus in deno desktop - Less overhead on every async call into the runtime - Hardened Node-API support - many more 👇 A total of 100 fixes and performance improvements in this release. deno upgrade

deno desktop is INSANELY thorough. I assumed it would be super basic but it's actually a real electron killer. Notifications, DMGs, support for bundled CEF (Electron style) and native WebView (Tauri style), Auto-updater, multi-window support, and on and on. @deno.land cooked so hard with this one.

Deno 2.8.1 is out - 33 bug fixes plus several security advisories addressed. All users are strongly encouraged to update as soon as possible. github.com/denoland/den...

Firefox now supports Web Serial on desktop 🦊 This means web apps can connect to compatible hardware devices such as microcontrollers, development boards, 3D printers, power meters, and other serial-connected hardware. Allowing the Web to do even more! 📖Read more: 🧵👇️ (1/11)

Deno 2.8 is released! - 6 new subcommands - defaulting to "npm:" - Node.js api compat: 42% → 74% - import defer - 3.6× faster cold npm installs - Network debugging in Chrome DevTools - TypeScript 6 - catalog: support - Cross-platform npm installs - deno install --prod

npm user? 💡 One small change to stay safe ➡️ Add these @socket.dev Firewall aliases and forget about it ➡️ npm install blocks known malware I use this: - locally, to stay safe - in my CI to detect compromised transitive deps early This completes the pnpm release cooldowns nicely

🚨 BREAKING: Socket is investigating an active npm supply chain attack compromising hundreds of packages in the @​antv ecosystem. The malicious publish wave appears tied to Mini Shai-Hulud and packages connected to the npm maintainer account atool.

Deno 2.8 ships this week. Our biggest minor release ever. Node.js compatibility: 42% → 75%+ this year. 500+ Node compat commits since 2.7. TypeScript 6.0.3, `import defer` support, several new subcommands, catalog workspaces, CPU flamegraphs, and many more.

84 TanStack npm package artifacts were compromised in the ongoing Mini Shai-Hulud supply chain attack, adding suspected CI credential-stealing malware. Socket flagged every malicious version within six minutes of publication. Details: socket.dev/blog/tanstac...

we launched a new @e18e.dev mini-site today! replacements.fyi acts as a super simple frontend to the module replacements data. we noticed the data wasn't very discoverable, so this is a focused tool for when you want to quicky look up if something has alternatives (esp. native ones!)

@juergengutsch.bsky.social I saw that 😁 Mr. SharpCMS

🚨 North Korea’s Contagious Interview campaign is now spreading across 5 ecosystems. We found coordinated malicious packages on npm, PyPI, Go Modules, Crates, and Packagist delivering staged RAT payloads that steal credentials, wallets & browser data. socket.dev/blog/contagi...

North Korea is targeting npm maintainers. Not for crypto. For write access to packages downloaded trillions of times a year. Lodash. Fastify. axios. mocha. Node.js core. Even @feross.bsky.social and several @socket.dev engineers! socket.dev/blog/attacke...

"Axios npm Packages Compromised in Supply Chain Attack" 👉 thecybersecguru.com/news/axios-n... Maybe you should have less dependencies in your project and lean more on established web standards. Maybe, IDK.

This kind of attack is getting more and more common. Early in my career I used to update dependencies blindly — not anymore. For a few years now I’ve been locking packages to specific versions, reading changelogs carefully, and setting a `cooldown` in Dependabot (link in thread).

🚨 Active supply chain attack on axios@1.14.1. The latest version pulls in plain-crypto-js@4.2.1 -- a brand-new package that didn't exist before today. We're still investigating. If you use axios, pin your version and audit your lockfile. socket.dev/blog/axios-n...

CSS is DOOMed! I've build DOOM in CSS and every wall, floor, barrel, and imp is a div, positioned in 3D space using CSS transforms. cssdoom.wtf Try it out! But... not every browser can handle it. This is taking the browser to its limit. Chrome has some issues. Safari too. Bugs will be filed.

Remember to periodically verify that you've opted out of GitHub's Copilot data collection bullshit. I thought I had done that, but nope... 👉 github.com/settings/cop...

Can't pivot to AI until after the pivot to video, so… 🤷 www.youtube.com/watch?v=RfNz... #css #webdev

📢 Code.Movie 0.0.40 Includes improvements for dealing with MANY obscure CSS features, heuristics improvements and support for .env syntax Blog post: code.movie/blog/improve... On NPM: www.npmjs.com/package/@cod...

TypeScript 6.0 is now available! This release brings better type-checking for methods, new standard library features, new module features for Node.js, and more! But most important, this release brings us one step closer to the upcoming native-speed 7.0! devblogs.microsoft.com/typescript/a...

You might have noticed me sharing a lot of posts from ex-Deno folks. I'd unhesitatingly go to bat for, work with, or hire each and every one of my now-former colleagues in a heartbeat. To a person, these are brilliant, kind, thoughtful humans who are each exceptionally excellent at what they do.

I miss monkeyuser.com 😅

It's about time! Configure and monitor your cron tasks with Deno Deploy. docs.deno.com/deploy/cron/

Version 2.7 der Runtime für JavaScript und TypeScript stabilisiert die Temporal API, führt npm-Overrides ein und verbessert die Node.js-Kompatibilität deutlich. #JavaScript

Deno v2.7 is here! 🕛 Temporal API stabilized 🪟 Windows ARM native support ⚙️ npm overrides support 📦 deno compile --self-extracting 🩹 Node compat fixes ...and more! deno.com/blog/v2.7

If you heard: "Don't bother learning to code, AI will do it all." They're wrong. Here's why. adventures.nodeland.dev/archive/yes-...

Kann ich in Angular auf #Rxjs verzichten? Das will ich heute abend im Livestream testen. Ich hab das schon mal versucht, vor 3 Jahren, damals war das nicht möglich. Jetzt mit #angular21 sieht das ganze schon vielversprechender aus. Start ist: 20:00 webdave.tv

We couldn't have built our own docs generation without @deno.land tools, here to collaborate with all registries @jsr.io 🤝 @npmx.dev

Mit Deno Deploy können Developer JavaScript- und TypeScript-Anwendungen ins Web deployen. Für erhöhte Sicherheit steht die neue Deno Sandbox bereit. #JavaScript

🤓💩 Save the date: I'm going to do some more verbal webdev shitposting at WeAreDevelopers LIVE next Wednesday! 👉 www.wearedevelopers.com/en/live

Anyway, here's Code.Movie version 0.0.39 with just a few minor bug fixes and stability improvements—things like the inconsistency shown in the attached animation. 👉 Full list of changes: code.movie/blog/many-sm...

Introducing Deno Sandbox ⭐ Instant Linux microVMs ⭐ TypeScript and Python (!) SDKs + REST API ⭐ Secure against prompt injection attacks deno.com/blog/introdu...

Save the Date: Vom 29. Juni bis 2. Juli 2026 halte ich wieder die Vanilla-Webdev-Stellung auf der DWX in Mannheim! Das finale Programm steht noch nicht, aber ich werde zumindest etwas über Scheduling-Techniken mit JS Generators erzählen, wenn nicht noch mehr. 👉 www.developer-world.de/dwx

Thread 👇 bsky.app/profile/qntm...

🚨 @workingdraft.de XXL 🚨 Aufnahme zur Folge 700 (!!!) läuft

Save the Date: Am 16. März übernehme ich auf den JavaScript- und Angular-Days die Show für RICHTIGES JavaScript. Keine KI, kein Malen-nach-Framework-Zahlen — bei mir dürft ihr euer Gehirn noch benutzen, etwa beim Ritt durch JavaScript-APIs, die keiner kennt. 👉️ javascript-days.de/javascript/d...

Neues Jahr, neues #Workshop-Programm: „Senior #JavaScript: Die unbekannten Ecken meistern“ 👉 www.developer-world.de/dwx-academy/... Thema: neuer Stoff für #JavaScript- und #TypeScript-Entwickler:innen, die schon alles wissen (oder zu wissen GLAUBEN). Proxies, Generators, Symbols und viel mehr!

Deno 2.6 is here: 🛠️ `dx` is the new `npx` ⚡ faster typechecking with tsgo 🔒 improved security with `deno audit --socket` 🦺 safer deps with `deno approve-scripts` 🚘 source phase import support and more! deno.com/blog/v2.6

I am burning out on this... Multiple PRs created by AI-bot accounts are trying to solve the same issue that has not yet even been identified, with verbose plain-text PR descriptions. I don't even know if I should bother to reply... Any ways to stop this? 😇

Our Deploy platform continues to ramp up, and after exploring it for while @philhawksworth.dev has some highlights to share. deno.com/blog/deno-de...

Look who got off his ass and finally improved his side project's website! 👉 code.movie Key achievements: - The "design" now has some contrast - The playground finally lazy-loads language modules - Performance in general rips, thanks to a bit of SSR and some CSS tweaks LMK if something's broken!

Deno 2.5.4 has been released github.com/denoland/den...