Node Weekly

npm to scan packages for malware at publish time

Thu, 30 Jul 2026 00:00:00 +0000

#635 — July 30, 2026

The Secure Way to Release an npm Package in 2026 — A practical guide to publishing npm packages more safely in 2026, written by someone who's released several popular packages (like postcss and nanoid). As well as showing how to use things like staged publishing and trusted publishing, he explains why and the security benefits of doing so.

Andrey Sitnik

Ship Node and Bun Apps in Minutes — Link your repo and Render takes it from there, handling every build, deploy, and SSL cert. Loop in your agent with official Render /plugins for Codex and Claude Code. Start free and scale from there.

Render sponsor

npm to Scan Every Package For Malware at Publish Time — The npm registry is beginning to scan packages at publish time, meaning new versions can take several minutes to become installable, and could be held or blocked.

GitHub

IN BRIEF:

🔒 The Wednesday, July 29, 2026 Security Releases of Node are available as Node v26.5.1, v24.18.1 and v22.23.2. 11 CVEs are tackled, including two HTTP/2 flaws, a Permission Model allowlist bypass, and more.
Microsoft is previewing a way to call native Windows APIs from Node (and therefore Electron) without native addons via a new dynamic Windows Runtime API (WinRT) projection.
Amazon's security team has narrowed down several npm supply chain attacks (such as those on debug and chalk) to a single North Korean-linked group.
Cloudflare's wrangler can now run integration tests against Workers from any Node.js test runner.

Check Out Node's New API Documentation Preview — Node's official API docs have been getting redesigned (now sharing a design system with nodejs.org itself) and have a new built-in search feature. You're invited to try the preview here and report what breaks.

Guilherme Araújo (Node.js Team)

How GitHub Is Disrupting Supply Chain Attacks on npm and Actions — Separate to the scanning news above, GitHub's team explains recent npm and Actions changes designed to mitigate supply chain attack techniques.

Ose and Steindler (GitHub)

📄 Finding Eight High-Severity Vulnerabilities in NodeBB in Six Hours Jorian Woltjer (Aikido)

📄 Running npm in a Separate Container When Using Claude Bryan Hogan

📄 Integration Testing with Node and Testcontainers Flavio Copes

🛠 Code & Tools

scriptc: Vercel's New TypeScript-to-Native Compiler — A new entry into the growing field of JS/TS native ahead-of-time compilers that makes the promise that "what compiles behaves byte-for-byte like Node." Static by default, but you can opt in to a --dynamic mode which embeds a JavaScript engine for runtime dynamism. GitHub repo.

Vercel Labs

Fast Endpoints Shouldn't Choke on Analytics — TimescaleDB extends Postgres so heavy queries stay fast at scale. One database, not two. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

tslog 5: Zero-Dependency Logger for Node, Deno, Bun and Browsers — A ground-up rewrite that's now ESM-only. Pretty output by default, JSON optionally, plus middleware, file/HTTP/worker transports, secret masking, and error stacks that resolve through source maps to your .ts code. GitHub repo.

Eugene Terehov

npm-check-updates 23.0: Find Newer Versions of Dependencies — Find newer versions than your package.json allows. Has a -i interactive mode to look at upgrades and opt in to them one by one. Supports custom cooldown periods. v23 is faster, smaller, and is now a pure ESM package.

Raine Revere

jsdom 30.0: Pure JS Implementation of Web Standards for Node — The venerable browser-environment emulator used by countless test suites. v30.0 adds CSS.escape(), CSS.supports(), background-position-x/y, as well as some fixes.

Denicola, Insua, et al.

crypto-random-string 6.0: Generate a Cryptographically Strong Random String — For example: cryptoRandomString({length: 10}) might return 2cf05d94db. v6.0 improves performance and removes cryptoRandomStringAsync.

Sindre Sorhus

Ada v4 – The WHATWG-compliant URL parser used by Node is now even faster.
Wasp v0.25 – The Rails-esque framework for building full-stack webapps with React & Node introduces Vite 8 and React Router 8.
modern-tar 0.8 – Zero-dependency streaming tar parser and writer.
📋 tinyclip 1.0 – Cross-platform clipboard utility library.
Nub 0.6 – Fast all-in-one toolkit that augments Node.
Verdaccio 6.9 – Self-hostable private npm registry.

Domenic Denicola's modern dev setup

Thu, 23 Jul 2026 00:00:00 +0000

#634 — July 23, 2026

Read on the Web

No, We Can't Harden Node.js Against Prototype Pollution — An explanation of why the Node team rejects prototype pollution reports against core: each assumes the attacker can already write to Object.prototype, by which point the game is over. The true fix lives at the boundary where untrusted JSON becomes objects.

Matteo Collina

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No stale results, no ETL, no Elasticsearch cluster.

ParadeDB sponsor

Domenic Denicola's Agentic Coding Setup — It's fascinating when a prolific developer (Domenic was a key figure in the adoption of promises in JavaScript, creating jsdom, and much more) shares their workflow. This is no exception, covering areas like disposable VMs, Tailscale, and worktrees.

Domenic Denicola

IN BRIEF:

⚠️ A round of July 27 Node.js security releases has been announced, with Node 26.x, 24.x, 22.x being updated to resolve a HIGH severity issue.
🏆 The OpenJS Foundation is showcasing a ranking of the top contributors to its projects (which include Node, Express, and Electron) in the past year. Matteo Collina leads the way…just!
Over on 𝕏, the Bun team is teasing the imminent release of Bun 1.4, which will have the "biggest jump in Node.js compatibility since Bun v1.0".
pnpm has had a flurry of releases introducing native workspace release management, a doctor command to diagnose installation issues, and more.
ESLint now provides official 'codemods' for automating ESLint version migrations, with v8→v9 and v9→v10 available.

better-sqlite3 13.0: The Popular SQLite Library Moves to N-API — The good news is prebuilt binaries should now work across different versions of Node and Electron. There's also a new db.explain() method and a preparedStatement.toString() method to get the expanded SQL of a prepared statement.

Joshua Wise

High-Ingest Analytics, Still Just Postgres — TimescaleDB extends Postgres to ingest and query events at scale. One database, standard SQL. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

📄 Unpacking the AsyncAPI npm Supply Chain Compromise – It seems attackers have already adapted to a world where post-install scripts are no longer run. Microsoft Security Research

📄 New Study Identifies 53 Slopsquatting Targets Across 5 Popular LLMs – LLMs continue to make up npm package names. Sarah Gooding

📄 Running Background Jobs in Node.js with BullMQ Flavio Copes

🛠 Code & Tools

Execa 10.0: Better Process Execution from Node — A powerful way to run processes that makes passing in input, processing output, handling errors, piping things around, and handling streams easy. v10 trims the API and adds new stream conversion powers and a killDescendants option to terminate a subprocess's descendant processes.

Sindre Sorhus

eslint-package-json: Powerful ESLint Rules for package.json — An ESLint plugin that catches package.json mistakes like invalid names, bad version ranges, broken exports, redundant files entries, and more, and fixes many of them automatically.

Sindre Sorhus

🤖 BotKit: Build Standalone ActivityPub Bots — A way to run a bot (or multiple bots) that Mastodon users can see and follow but without needing an account anywhere. Write it all in JavaScript and self-host. I spun one up with Node (temporarily) and it worked well.

Fedify

Nub 0.5 – The all-in-one toolkit that augments Node's feature set. v0.5 adds nub init as a way to quickly scaffold new projects.
odiff 4.5 – Fast SIMD-powered image comparison library. Written in Zig with Node bindings.
node-html-to-image 6.2 – A function to generate images from HTML.
find-my-way 9.7 – Fast radix-tree based HTTP router used by Fastify.
Gitify 7.0 – Electron-powered Git notifications menu bar app.
Verdaccio 6.8 – Self-hostable Node.js private proxy registry.
Piscina 5.3 – Popular worker thread pool implementation.
Prisma 7.9

📰 Classifieds

⚡ Zuplo puts every API, AI, and MCP request behind one gateway. Route traffic, guard your MCP servers, and cap your AI costs. Try it free.

The life of a ~200ms HTTP request to a Node app

Thu, 16 Jul 2026 00:00:00 +0000

#633 — July 16, 2026

Read on the Web

Follow a Single HTTP Request Through Its ~200ms Life — From the creator of NodeBook, a thorough guide to Node's internals, comes a scroll-driven visualization following every step a single HTTP POST request takes from the user's click to Node's event loop and on to a database behind it.

Ishtmeet Singh

The Best Harness Wins, Not the Best Model. Learn Harness Engineering — Scott Moss (Netflix) teaches you to wrap an LLM in a production-grade harness. Learn durable execution, sandboxing, memory, and multi-agent orchestration.

Master.dev sponsor

Fetch Needs Error Codes — e.cause.code lets you find out why a fetch() failed in Node, but the spec says failures are just bare TypeErrors, so HTTP/2/3 typed signals like "safe to retry this POST" go missing. James, who created Node's error code convention, is pushing a TC39 proposal to standardize a fix.

James M Snell

IN BRIEF:

Ant is a new entry to the growing field of JavaScript runtimes. This time, it's an independent engine written in C packed into a 9MB binary that boasts very low cold start times and can run Hono apps.
If you're considering using Go at all, this 'from Express to Fiber' guide with examples in both JavaScript and Go (on the Express-inspired Fiber framework) could be helpful.
🇮🇹 NodeConf EU 2026 takes place this September 29-30 in Italy. Tickets are still available.
Vercel is deprecating Node 20 for Builds and Functions on October 1, 2026.

Proxy and Reflect: Redefining How Objects Fundamentally Work — A deep dive into intercepting the internal operations of JavaScript objects, covering why Reflect exists at all, and ending with a small reactive state system.

Mat Marquis

Telegram Serverless: Run Telegram Bots on Telegram's Servers — Creating a bot for Telegram is easy (it has a great API) with libraries like node-telegram-bot-api, but it's starting to support running them on its own servers.

💡 The serverless program is in beta, so not all users will have access to it yet.

📄 A Gentle Introduction to Git Worktrees – For when you need to check out multiple branches into separate directories simultaneously. Nicholas C. Zakas

📄 Playwright on GitHub Actions: A Setup That Actually Runs Fast – How to cut Playwright CI time by caching browser binaries, lifting the scaffold's one-worker cap, and more. Jakob Norlin

📄 6 Security Settings Every GitHub Maintainer Should Enable This Week Joseph Katsioloudes (GitHub)

🛠 Code & Tools

LiteParse 2: Fast, Light PDF Document Parsing — A PDF parser built in Rust with bindings for Node (plus WASM, Rust, and Python) — it worked great in my testing. It includes OCR, handles layouts/is spatially aware, and is fast (a complex 140-page PDF took ~10 seconds). Here's how to get started from Node.

LlamaIndex

One Postgres for Your API and Your Analytics — TimescaleDB extends Postgres so your app and analytics run in one database at scale. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

actions/setup-node@v7: Install Node in GitHub Actions — The popular way to set up an Actions workflow with a version of Node brings changes supporting GitHub's cache-poisoning defenses, inspired by recent exploits. There are also new docs on publishing to npm with Trusted Publisher (OIDC).

GitHub

🎬 Mediabunny: A Full Media Toolkit for JavaScript — It's been a year since we mentioned this library for reading/writing/converting media formats (MP4, MP3, and more). Since then, it's added Apple ProRes, HLS read/write, and a new server package that makes it all even easier to use from Node.

Vanilagy

Tinbase: A Supabase-Compatible Backend in a Single Binary — Provides a local Supabase-like dev experience using a JS backend built atop PGlite and pg-mem. A sort of mini, local-only Postgres wrapped in the same APIs as Supabase, so supabase-js works unchanged.

Sanket Sahu

@neon/sdk: Neon's New TypeScript Client Library — For users of the Neon Postgres platform to manage projects, branches, and databases from code.

Andre Landgraf (Neon)

Nano ID 6.0 – Generate tiny URL-friendly unique string identifiers. Now 4x faster and drops Node 18/20 support.
c8 12.0 – Istanbul-compatible coverage reports using Node's built-in V8 data. Node's test runner also has its own experimental code coverage reporting.
np 12.0 – Sindre Sorhus's "better npm publish" adds support for npm 12 and staged publishing.
HyperExpress 7.0 – A high performance Node server powered by uWebSockets.js.
Helmet 8.3 – HTTP security header hardening for Express apps.
node-auth0 6.0 – One for Auth0 users.
ESLint 10.7

📢 Elsewhere in the ecosystem

TypeScript-using AWS SDK for JavaScript v3 users need to be aware of changes to the library's support for TypeScript versions.
GitHub's Dependabot is now giving packages a three-day default cooldown before opening version update PRs, though security fixes are exempt.
TC39's 115th meeting takes place next week. Here's the agenda, including Await Dictionary aiming for Stage 3, plus Decimal, Import Defer, and Map.take.
📁 Cloudflare has launched 'Drop', a way to quickly get a site live by dropping a folder or ZIP onto a page, similar to Netlify's service of the same name.
plx is a transpiler for Postgres stored functions that converts JavaScript, PHP, Python, Ruby, and even COBOL, to Postgres's own PL/pgSQL language.

npm v12 and TypeScript 7 released

Thu, 9 Jul 2026 00:00:00 +0000

#632 — July 9, 2026

Read on the Web

npm v12 Ships with Install Scripts Off by Default — npm 12 is now GA with many breaking changes. The headline change is lifecycle scripts and implicit node-gyp builds no longer run by default. Socket’s Sarah Gooding writes more about the practical implications including, thankfully, that unknown .npmrc keys will now only warn rather than error as they did in the pre-releases.

GitHub

Your Next.js App Is Already Tracing. Now Make It Useful — When a Next.js page is slow, the hard part is finding which part is responsible: middleware, SSR, an API route, a query, or a fetch call. 🔍 Next.js is already tracing all of it. Here's how to actually see it and put it to use.

Sentry sponsor

Node.js 26.5.0 (Current) Released — Key additions include the ability to import text files into ES modules via import attributes (behind an experimental flag), blob.textStream() (good for streaming large blob content), and being able to sample event-loop delay per iteration via perf_hooks.

Richard Lau

IN BRIEF:

Bun's Jarred Sumner wrote up the full story of rewriting Bun in Rust, a somewhat controversial AI-powered port that will power Bun 1.4 onward. The cost? ~$165k of Fable usage, at API prices.
James Snell has a TC39 proposal to standardize a code property on Error (as has long been common in Node).
Better Auth, the framework-agnostic auth library, is joining Vercel.

TypeScript 7.0 Released — Over a year after announcing TypeScript would be ported to Go, the final release is out. Don't rush to upgrade: TS 7.0 doesn't ship with an API yet, and 6.0 is still a good stepping stone. If you do upgrade, expect to see huge build time speedups, once moduleResolution: node is switched to nodenext and you've sorted out "types": ["node"].

Microsoft

CVE-2026-48931 Shouldn't Have Been a CVE — A candid post-mortem from a Node maintainer explaining a recent snafu around an HTTP/1.1 poisoning issue he now argues shouldn’t have been a CVE, especially after the fix broke node-fetch, Firebase, and the official Docker images.

Matteo Collina

What's New in ECMAScript 2026 — The ECMAScript 2026 spec was approved last week, and this round-up covers several main new features that made the cut, with all (except Math.sumPrecise) available in Node today.

Pawel Grzybek

📄 You Shouldn't Trust Trusted Publishing – npm added trusted publishing, but it’s authentication, not a safety or quality badge. Matteo Collina has also written about this from the npm perspective before. William Woodruff

📄 Node.js Worker Threads in Production – Hard-won lessons from running worker threads at scale. Aaron Harper (Inngest)

🛠 Code & Tools

terminal-image 5.0: Display Images in the Terminal — Works in any terminal that supports colors by rendering colored blocks, but can render images inline in terminals that support inline graphics. v5.0 improves iTerm2 support by using its native inline image support, rather than the Kitty protocol.

Sindre Sorhus

Full-Text Search in Drizzle Without a Second System — Try the official ParadeDB integration for Drizzle. Search your live Postgres tables. No ETL, no Elasticsearch cluster.

ParadeDB sponsor

eslint-node-test: ESLint Rules for Node's Built-In Test Runner — In Sindre’s own words: “If you use the Node.js test runner (node:test), you may like the new ESLint plugin I cooked up. 64 [now 82] rules to improve your tests, prevent mistakes, and enforce style.”

Sindre Sorhus

✉️ Upyo 0.5: A Cross-Runtime Email Sending Library — A unified, type-safe API for sending emails both on SMTP and HTTP-based (e.g. SendGrid or Amazon SES) providers from Node, Deno, Bun, and edge function runtimes.

Hong Minhee

webpack-dev-server 6.0: The Official webpack Dev Server — Bumps Express up to v5, drops support for older Node versions, adds support to be used as a webpack plugin, and switches to ESM.

webpack

XO 4.0 – Opinionated but configurable ESLint wrapper that includes numerous popular ESLint plugins and rules out of the box.
ESLint Plugin Perfectionist 5.10 – For when you're really particular about the ordering of things like objects, imports, and types.
MongoDB Node.js Driver 7.5 – Official driver for MongoDB. Now supports Queryable Encryption string queries on MongoDB 9.0.
🐍 node-calls-python 1.2 – Call Python from Node directly, in-process, without spawning processes.
FoalTS 5.3 – The full-featured Node.js app framework adds a new dev-verbose logging format.
Fastify 5.10.0 – The fast and low overhead web framework.
feed 6.0 – RSS, JSON, and Atom feed generator library.

📰 Classifieds

📈 Crystallize seeks a remote SRE who thinks in SLOs, not heroics. Node/TS, GraphQL.