must be the biggest saving i've seen an npm package do
November 6, 2026 at 11:39 AM
must be the biggest saving i've seen an npm package do
They accidentally shipped GTA6 as an npm dependency
November 6, 2026 at 2:15 PM
They accidentally shipped GTA6 as an npm dependency
Electrobun continues to have 80,000 downloads per week on npm
November 5, 2026 at 6:11 PM
Electrobun continues to have 80,000 downloads per week on npm
wait… you know that spell too?
trash node_modules packages/*/node_modules; npm i && npm ls && git add -A package-lock.json toil & trouble
trash node_modules packages/*/node_modules; npm i && npm ls && git add -A package-lock.json toil & trouble
November 6, 2026 at 5:26 AM
wait… you know that spell too?
trash node_modules packages/*/node_modules; npm i && npm ls && git add -A package-lock.json toil & trouble
trash node_modules packages/*/node_modules; npm i && npm ls && git add -A package-lock.json toil & trouble
Oh God TIL I have an 11 year old package I fired and forgot to npm with 2.7k packages depending on it
November 7, 2026 at 5:23 AM
Oh God TIL I have an 11 year old package I fired and forgot to npm with 2.7k packages depending on it
Nyliberalism, npm leder till barbari.
Det är en deppig arbetsuppgift att försöka förstå det ekonomiska läget vid landets universitet. Samtliga hittills granskade lärosäten beskriver statliga effektiviseringskrav som är svåra (omöjliga förmodar jag) att klara av. *tråd*
November 3, 2026 at 4:13 PM
Nyliberalism, npm leder till barbari.
that's what "npm run build" does, from the "building" instructions
November 7, 2026 at 3:01 PM
that's what "npm run build" does, from the "building" instructions
Petition that we replace "there's a bridge in Brooklyn I want to sell them" with "there's a package on NPM I want them to download".
November 5, 2026 at 4:32 PM
Petition that we replace "there's a bridge in Brooklyn I want to sell them" with "there's a package on NPM I want them to download".
Det här avsnittet i Göteborgs Universitets årsredovisning om nedskärning, förlåt jag menar "omställning", är bland de värsta exemplen på NPM-lingo jag någonsin läst.
November 2, 2026 at 11:13 AM
Det här avsnittet i Göteborgs Universitets årsredovisning om nedskärning, förlåt jag menar "omställning", är bland de värsta exemplen på NPM-lingo jag någonsin läst.
Use FlubDB. BonkDB can do it. WhamDB is 1087x faster than Postgres. SlopDB has what you need. Use SlopDB in prod. Everything is stored in SlopDB. npm install SlopDB.
there is no reason to make a new database. postgres can do it. if you think postgres can't do it, you just haven't found the right way to enable it in pg_settings yet
November 2, 2026 at 3:27 AM
Use FlubDB. BonkDB can do it. WhamDB is 1087x faster than Postgres. SlopDB has what you need. Use SlopDB in prod. Everything is stored in SlopDB. npm install SlopDB.
Just the accumulation of heavyweight features I'm not sure any of us need. E.g. rust and python package management. pnpm gains ~1MB/release right now.
I'd love a "pnpm lite" that does what it is good at: being an npm alternative
I'd love a "pnpm lite" that does what it is good at: being an npm alternative
November 7, 2026 at 1:17 AM
Just the accumulation of heavyweight features I'm not sure any of us need. E.g. rust and python package management. pnpm gains ~1MB/release right now.
I'd love a "pnpm lite" that does what it is good at: being an npm alternative
I'd love a "pnpm lite" that does what it is good at: being an npm alternative
codex-security npm-v0.8.3 — OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security https://ktp.sh/8piYkWZ1To
November 4, 2026 at 12:53 PM
codex-security npm-v0.8.3 — OpenAI's Codex Security CLI and TypeScript SDK for finding, validating, and fixing security vulnerabilities. npm: https://www.npmjs.com/package/@openai/codex-security https://ktp.sh/8piYkWZ1To
🟡 npm: Minor issues impacting package publish
Package publishing does not work on npm. npm reports minor issues that impact package publish. npm is investigating the issue.
Degraded · Package publishing
https://outages.live/outages/npm-iu5qlij3x5
Package publishing does not work on npm. npm reports minor issues that impact package publish. npm is investigating the issue.
Degraded · Package publishing
https://outages.live/outages/npm-iu5qlij3x5
npm: Minor issues impacting package publish
Package publishing does not work on npm. npm reports minor issues that impact package publish. npm is investigating the issue.
outages.live
November 7, 2026 at 2:30 PM
🟡 npm: Minor issues impacting package publish
Package publishing does not work on npm. npm reports minor issues that impact package publish. npm is investigating the issue.
Degraded · Package publishing
https://outages.live/outages/npm-iu5qlij3x5
Package publishing does not work on npm. npm reports minor issues that impact package publish. npm is investigating the issue.
Degraded · Package publishing
https://outages.live/outages/npm-iu5qlij3x5
Vad bra Bandcamp funkar sen de sparkade en massa tekniker, npm…
November 3, 2026 at 7:28 PM
Vad bra Bandcamp funkar sen de sparkade en massa tekniker, npm…
Which itself depends on is-number (all three and more by the same person).
npm package download numbers being a vanity metric really did have the most foreseeable consequences.
npm package download numbers being a vanity metric really did have the most foreseeable consequences.
November 5, 2026 at 2:07 PM
Which itself depends on is-number (all three and more by the same person).
npm package download numbers being a vanity metric really did have the most foreseeable consequences.
npm package download numbers being a vanity metric really did have the most foreseeable consequences.
Every AI wrapper startup is one dependency confusion away from a very bad week. Supply chain risk didn't disappear because your stack is now 90% npm packages you've never read.
November 6, 2026 at 3:19 PM
Every AI wrapper startup is one dependency confusion away from a very bad week. Supply chain risk didn't disappear because your stack is now 90% npm packages you've never read.
`npx get-pnpm` でpnpmインストールできるようになってた
github.com/pnpm/get.pnp...
github.com/pnpm/get.pnp...
feat: add get-pnpm, the installer as an npm package by zkochan · Pull Request #51 · pnpm/get.pnpm.io
Summary
Moves get-pnpm — the installer as an npm package, npx get-pnpm — out of the pnpm monorepo and in here, beside the two installers it duplicates in miniature.
It was built in pnpm/pnpm#13732,...
github.com
November 5, 2026 at 6:34 AM
`npx get-pnpm` でpnpmインストールできるようになってた
github.com/pnpm/get.pnp...
github.com/pnpm/get.pnp...
But with that checked in you don't have to "npm install" - that can also save a lot of time...
I'm pretty sure they measured it...
I'm pretty sure they measured it...
November 3, 2026 at 7:41 PM
But with that checked in you don't have to "npm install" - that can also save a lot of time...
I'm pretty sure they measured it...
I'm pretty sure they measured it...
vercel now blocks known-malicious npm versions before + during install 🛡️
checks the lockfile even from cache. no config. build fails with the bad pkg+version
supply-chain attacks keep winning on install scripts. this is the boring fix that ships
checks the lockfile even from cache. no config. build fails with the bad pkg+version
supply-chain attacks keep winning on install scripts. this is the boring fix that ships
Blocking malicious npm packages before and during installation - Vercel
Vercel now checks for blocked npm package versions before and during installation, helping prevent malicious install scripts from running in new builds.
vercel.com
November 6, 2026 at 11:22 AM
vercel now blocks known-malicious npm versions before + during install 🛡️
checks the lockfile even from cache. no config. build fails with the bad pkg+version
supply-chain attacks keep winning on install scripts. this is the boring fix that ships
checks the lockfile even from cache. no config. build fails with the bad pkg+version
supply-chain attacks keep winning on install scripts. this is the boring fix that ships
November 3, 2026 at 11:08 PM
Sonatype uncovers the PolinRider loader in 12 releases across 10 hijacked packages. See how the npm PolinRider loader uses Ethereum to fetch malware.
#PolinRider #npmSecurity #SupplyChainSecurity #Sonatype #Ethereum #JavaScript #Cybersecurity
#PolinRider #npmSecurity #SupplyChainSecurity #Sonatype #Ethereum #JavaScript #Cybersecurity
PolinRider Loader Hits 10 Hijacked npm Packages Using Ethereum Dead-Drop Resolver
TL;DR Sonatype Research Labs identified a concealed PolinRider loader inside 12 releases across 10 hijacked npm packages. Instead of using installation hooks, this npm PolinRider loader runs when an application imports an affected module or starts a bundled service. Furthermore, the malware reads Ethereum blockchain transactions to locate its command server and run XOR-decoded JavaScript in detached background processes. Delivery and Attribution…
securityonline.info
November 7, 2026 at 1:50 AM
Sonatype uncovers the PolinRider loader in 12 releases across 10 hijacked packages. See how the npm PolinRider loader uses Ethereum to fetch malware.
#PolinRider #npmSecurity #SupplyChainSecurity #Sonatype #Ethereum #JavaScript #Cybersecurity
#PolinRider #npmSecurity #SupplyChainSecurity #Sonatype #Ethereum #JavaScript #Cybersecurity
🟡 npm: Minor issues impacting package publish
Minor issue · Developer Tools · since 14:28 UTC
Affected: Package publishing
Our probes: registry.npmjs.org reachable from all 8 regions
Details ↗ · #Npm
Minor issue · Developer Tools · since 14:28 UTC
Affected: Package publishing
Our probes: registry.npmjs.org reachable from all 8 regions
Details ↗ · #Npm
npm status: minor issue
Live status for npm, checked from regions around the world.
flarewarden.com
November 7, 2026 at 2:31 PM
✅ npm: minor issue resolved after 37 m.
Our probes: registry.npmjs.org reachable from all 8 regions
Details ↗
Our probes: registry.npmjs.org reachable from all 8 regions
Details ↗
npm status
Live status for npm, checked from regions around the world.
flarewarden.com
November 7, 2026 at 3:07 PM
✅ npm: minor issue resolved after 37 m.
Our probes: registry.npmjs.org reachable from all 8 regions
Details ↗
Our probes: registry.npmjs.org reachable from all 8 regions
Details ↗
PolinRider-Loader in 10 gekaperten npm-Paketen entdeckt
In 12 Releases von 10 manipulierten npm-Paketen wurden versteckte Loader gefunden. Der Schadcode läuft ohne Installations-Hook und ermittelt seine Payload-Server über Ethereum-Transaktionen.
shorturl.at/QNQmf
#npm #security
In 12 Releases von 10 manipulierten npm-Paketen wurden versteckte Loader gefunden. Der Schadcode läuft ohne Installations-Hook und ermittelt seine Payload-Server über Ethereum-Transaktionen.
shorturl.at/QNQmf
#npm #security
PolinRider: Schadcode in gefälschten npm-Paketen
Wichtige Informationen über PolinRider: 12 Releases mit bösartigem Code in npm-Paketen aufgedeckt.
shorturl.at
November 7, 2026 at 9:12 AM
PolinRider-Loader in 10 gekaperten npm-Paketen entdeckt
In 12 Releases von 10 manipulierten npm-Paketen wurden versteckte Loader gefunden. Der Schadcode läuft ohne Installations-Hook und ermittelt seine Payload-Server über Ethereum-Transaktionen.
shorturl.at/QNQmf
#npm #security
In 12 Releases von 10 manipulierten npm-Paketen wurden versteckte Loader gefunden. Der Schadcode läuft ohne Installations-Hook und ermittelt seine Payload-Server über Ethereum-Transaktionen.
shorturl.at/QNQmf
#npm #security