warn: Bun currently does not support nested "overrides"
New York, NY
Joined April 2016
- Tweets202
- Following181
- Followers355
- Likes363
Official Node JS Teapot 🫖 (Bun, Deno, etc) retweeted
In the next version of Bun
`Bun.FetchSession` gives you a `fetch` function with its own keepalive connection pool
ALT Dark slide with the Bun logo and a "new in Bun" badge. Large headline: "Bun.FetchSession". Subtitle: "fetch() with its own connection pool." Below it, a code sample: const api = new Bun.FetchSession({ proxy: "http://proxy:8080", tls: { ca }, keepAlive: { idleTimeout: 30 }, }); await api.fetch(url); new Octokit({ request: { fetch: api.fetch }, }); "api.fetch" is highlighted in both places. Three cards at the bottom read: "Own pool: isolated keep-alive", "Proxy + TLS: set once per session", "Drop-in: works in any SDK".
Official Node JS Teapot 🫖 (Bun, Deno, etc) retweeted
TanStack compromised. More and more evidence to use these tools to start writing cleanroom versions of big npm packages and use that instead.
Official Node JS Teapot 🫖 (Bun, Deno, etc) retweeted
New in Zod 4.6 — .validate()
Unlike .parse(), this method returns a boolean, aborts early when it encounters the first error, and instantiates no issue objects. It is 13-39x faster than `.safeParse().success` on invalid data.
z.compile() walks the schema once at runtime, emits a flat, loop-free new Function() validator for the happy path, and falls back to the normal parser only on failure.
Yesterday, the npm was hit by the third-largest supply chain compromise in its history, a new Shai-Hulud (named for Dune sandworms). Diving into the code we find that—as in Heretics of Dune—the danger is not so much the worm itself as the ecology that has evolved around it:
Webernetes is a partial port of Kubernetes to TypeScript to make it possible to run clusters in the browser. (Github repo link in article)
Technically it's not *really* in-browser Kubernetes, but it does give you the control plane.
ngrok.com/blog/i-ported-kube…
Here we go again
🚨 Breaking: 31 npm packages from @RedHat have been compromised.
100,000+ weekly downloads affected. The upstream CI/CD pipeline was compromised, with all packages published via GitHub Actions OIDC.
The payload:
⚠️ Reads GitHub Actions runner process memory to extract masked secrets
⚠️ Sweeps credentials across AWS, GCP, Azure, K8s, Vault, and npm
⚠️ Self-propagating worm that republishes backdoored packages using stolen npm tokens, bypassing 2FA
⚠️ Persists on dev machines via Claude Code settings hijack and VS Code task injection
⚠️ Exfiltrates data through GitHub API commits, blending in with normal git operations
We have responsibly disclosed the incident to the maintainers.
Full technical analysis: stepsecurity.io/blog/multipl…
Sound Mode is tsz's experiment in stricter TypeScript checking: tsz.dev/sound-mode/
Official Node JS Teapot 🫖 (Bun, Deno, etc) retweeted
It isn't unexpected that the focus of the Bun Rust rewrite is on the anti-Zig side more than anything, since the internet loves to hate. What is unexpected and unfortunate is that leadership within Bun hasn't tried to steer the conversation away from that at all.
There are so many positive and interesting takeaways from this and I'm not really seeing any of them pushed as the primary message.
A positive thing that hasn't been talked about at all is how far Bun came thanks to Zig. And even if you dump it now, its meaningful for how good Zig was to even build a product to this point and impact by any metric. I would've loved to see anyone in leadership say this.
On the interesting side is how fungible programming languages are nowadays. Programming languages used to be LOCK IN, and they're increasingly not so. You think the Bun rewrite in Rust is good for Rust? Bun has shown they can be in probably any language they want in roughly a week or two. Rust is expendable. Its useful until its not then it can be thrown out. That's interesting!
There's been a lot of talk about memory safety and no doubt Rust provides more guarantees than Zig. But I'd love to see a better analysis of why Bun in particular suffered so much rather than take the language-blame path. How could engineering as a practice been more rigorous to prevent this? What were the largest sources of crashes other programs should watch out for? How does Rust prevent them? How could Zig theoretically prevent them? That's interesting.
I know the official blog post hasn't come out yet from Bun. But they're smart enough to know that that PR would stir up controversy the moment it opened, or they should've been. And plenty in the company have been tweeting and writing about it. Its somewhat telling to me in various dimensions what they chose to talk about first.
I tend to think I'm pretty good at corporate PR/comms (especially when it comes to developer audiences) and I think appealing to the negative is never the right long term strategy; it does work to get short term eyes though.
Official Node JS Teapot 🫖 (Bun, Deno, etc) retweeted
SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
github.com/TanStack/router/i…
Credit to the security researcher for responsible disclosure.
