Fran Herrero @leynar

Introducing eve, an agent framework. 𝚊𝚐𝚎𝚗𝚝/ 𝚊𝚐𝚎𝚗𝚝.𝚝𝚜 𝚒𝚗𝚜𝚝𝚛𝚞𝚌𝚝𝚒𝚘𝚗𝚜.𝚖𝚍 𝚝𝚘𝚘𝚕𝚜/ 𝚜𝚔𝚒𝚕𝚕𝚜/ 𝚜𝚊𝚗𝚍𝚋𝚘𝚡/ 𝚜𝚌𝚑𝚎𝚍𝚞𝚕𝚎𝚜/ Like Next.js, for agents. vercel.com/blog/introduci…

338 735 7K 2.6M 7K

View Details

practical mitigation[1] steps[2] against the tanstack compromise and other supply chain attacks on npm [1] reduces vulnerable surface [2] apply to your pnpm config too * see more security best practices on the repo

1 10 27 3K 30

View Details

Seb ⚛️ ThisWeekInReact.com @sebastienlorber

3 months ago

TL;DR for open-source maintainers 🚫 NEVER use "pull_request_target" workflows 🚫 NEVER use shared caches in your publish pipeline Combining these 2 in particular is extremely dangerous I've repeated this countless times over the years, but another reminder is always useful

TANSTACK @tan_stack

3 months ago

SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @TansTack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm

137 972 4K 3.9M 2K

26 219 2K 224K 1K

View Details

TANSTACK @tan_stack

3 months ago

SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/route… Credit to the security researcher for responsible disclosure.

137 972 4K 3.9M 2K

View Details

Feross @feross

4 months ago

🤨 People keep asking how to protect yourself. #1: set min-release-age=7 in .npmrc #2: install Socket for GitHub (it's free!) to protect PRs from bad dependencies: socket.dev/features/github #3: install Socket Firewall (also free!) to protect your laptop: socket.dev/features/firew…

Feross @feross

4 months ago

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages. The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise. This is textbook supply chain installer malware. axios

539 4K 16K 12.4M 7K

57 281 2K 348K 4K

View Details

Excalidraw @excalidraw

6 months ago

Thanks to good people at @AnthropicAI we now have an official MCP for Excalidraw! Take it for a spin on @claudeai (search for Excalidraw in Connectors, or use in Claude Code and elsewhere). More to come. ✌

David Soria Parra @dsp_

6 months ago

We are moving quickly. Thanks to Anton and the folks at @excalidraw , this is now the official Excalidraw MCP server. From weekend project to official server in less than a week.

13 20 316 598K 180

189 530 6K 800K 4K

View Details

Cory House @housecor

6 months ago

My big frustration with skills is they're not consistently invoked. In this post, Vercel saw the same issue. Their solution? Put a compressed index of docs in AGENTS .md instead. The improvement in results might be worth it for more general knowledge. vercel.com/blog/agents-md…

34 27 617 53K 796

View Details

Matteo Collina @matteocollina

6 months ago

🔥 I've been debugging @nodejs performance for over a decade. The hardest part? Making sense of thousands of stack frames in a flamegraph. What if your AI assistant could do that for you? Today, we're releasing a new feature in @platformatic/flame. 🧵

1 7 41 3K 23

View Details

Vercel @vercel

6 months ago

Skills.sh is an open ecosystem for finding and sharing agent skills. Add a skill to any agent with: ▲ ~/ npx skills add <owner/repo>

146 427 3K 647K 3K

View Details

ToonHive @ToonHive

6 months ago

The Season 2 ending of ‘Frieren: Beyond Journey’s End’ was fully hand-drawn using only colored pencils, created by artist Mimei Aoume (@aoumemimei).

325 13K 92K 9.8M 9K

View Details

Matteo Collina @matteocollina

7 months ago

Bun is fast, until latency matters for Next.js. We benchmarked the same Next.js app across Node.js, Deno, Bun, and Watt (our multi-threaded Node-based runtime) under identical load on AWS EKS. Throughput looked fine across the board. Latency told a very different story. 🧵

23 39 530 75K 247

View Details

Fran Herrero @leynar

7 months ago

@calcsam BOOK

0 0 0 9 0

View Details

Fran Herrero @leynar

7 months ago

tl;tr update you Node.js version ASAP

Matteo Collina @matteocollina

7 months ago

Today, @nodejs published a security release for Node.js that fixes a critical bug affecting virtually every production Node.js app. If you use React Server Components, Next.js, or ANY APM tool (Datadog, New Relic, OpenTelemetry), your app could be vulnerable to DoS attacks. 👇

79 450 3K 1.2M 2K

0 0 0 85 0

View Details

Fran Herrero @leynar

7 months ago

@itsolelehmann @wtmeersii ... with my family and two young kids. Great schools, many squares, Catalan people and young families. Life here is very good.

0 0 0 15 0

View Details

Fran Herrero @leynar

7 months ago

@itsolelehmann @wtmeersii Barcelona is a great city. Like any big city, it has some less recommendable areas, and at certain moments or in some high-immigration neighborhoods you may feel a bit uncomfortable. But honestly, much less than in Paris or London. I’ve lived in Bcn for 13 years, in Gràcia...