warn: Bun currently does not support nested "overrides"
New York, NY
Joined April 2016
- Tweets202
- Following181
- Followers355
- Likes363
Drizzle catching strays in the ORM obits while quietly building a *decent* business, by being the ORM for people who hate ORMs 😠 @DrizzleORM
Official Node JS Teapot 🫖 (Bun, Deno, etc) retweeted
In the next version of Bun
`Bun.FetchSession` gives you a `fetch` function with its own keepalive connection pool
ALT Dark slide with the Bun logo and a "new in Bun" badge. Large headline: "Bun.FetchSession". Subtitle: "fetch() with its own connection pool." Below it, a code sample: const api = new Bun.FetchSession({ proxy: "http://proxy:8080", tls: { ca }, keepAlive: { idleTimeout: 30 }, }); await api.fetch(url); new Octokit({ request: { fetch: api.fetch }, }); "api.fetch" is highlighted in both places. Three cards at the bottom read: "Own pool: isolated keep-alive", "Proxy + TLS: set once per session", "Drop-in: works in any SDK".
Official Node JS Teapot 🫖 (Bun, Deno, etc) retweeted
TanStack compromised. More and more evidence to use these tools to start writing cleanroom versions of big npm packages and use that instead.
Official Node JS Teapot 🫖 (Bun, Deno, etc) retweeted
New in Zod 4.6 — .validate()
Unlike .parse(), this method returns a boolean, aborts early when it encounters the first error, and instantiates no issue objects. It is 13-39x faster than `.safeParse().success` on invalid data.
z.compile() walks the schema once at runtime, emits a flat, loop-free new Function() validator for the happy path, and falls back to the normal parser only on failure.
The Oncoming Worm
xitter.gq/node_camp/status/20849…
Yesterday, the npm was hit by the third-largest supply chain compromise in its history, a new Shai-Hulud (named for Dune sandworms). Diving into the code we find that—as in Heretics of Dune—the danger is not so much the worm itself as the ecology that has evolved around it:
Webernetes is a partial port of Kubernetes to TypeScript to make it possible to run clusters in the browser. (Github repo link in article)
Technically it's not *really* in-browser Kubernetes, but it does give you the control plane.
ngrok.com/blog/i-ported-kube…
Here we go again
🚨 Breaking: 31 npm packages from @RedHat have been compromised.
100,000+ weekly downloads affected. The upstream CI/CD pipeline was compromised, with all packages published via GitHub Actions OIDC.
The payload:
⚠️ Reads GitHub Actions runner process memory to extract masked secrets
⚠️ Sweeps credentials across AWS, GCP, Azure, K8s, Vault, and npm
⚠️ Self-propagating worm that republishes backdoored packages using stolen npm tokens, bypassing 2FA
⚠️ Persists on dev machines via Claude Code settings hijack and VS Code task injection
⚠️ Exfiltrates data through GitHub API commits, blending in with normal git operations
We have responsibly disclosed the incident to the maintainers.
Full technical analysis: stepsecurity.io/blog/multipl…
Sound Mode is tsz's experiment in stricter TypeScript checking: tsz.dev/sound-mode/
