---
title: "Cryptographically valid malware hits npm"
publication: "JavaScript Weekly"
issue: 785
published_at: "2026-05-12"
canonical_url: "https://javascriptweekly.com/issues/785"
---

Plus: what $$$ does in DevTools, Rolldown 1.0, and Vercel's new cross-platform desktop app framework.        

#​785 — May 12, 2026 

[Read on the Web](https://javascriptweekly.com/issues/785)  

Together with [![Sentry logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_350,h_100/e_make_transparent/co_white,e_outline:7/xdmchdxkka938lxfr86f.png)](https://sentry.io/resources/nextjs-may-workshop/?utm_source=javascriptweekly&utm_medium=paid-community&utm_campaign=nextjs-fy27q2-nextjsworkshop&utm_content=newsletter-primary-register)   

JavaScript Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/ckou53i84jyf1ujrgken.jpg)](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem)  

[Anatomy of the TanStack npm Compromise](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem) — A new strain of the [Shai-Hulud worm](https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem) pushed malicious versions of TanStack packages to npm yesterday (containing a tripwire that would delete files if it detected token revocation), though [it hit ~170 other packages too](https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/). **Maintainer credentials weren’t stolen**, with the attack instead chaining `pull_request_target` abuse, cache poisoning, and OIDC token theft from CI_memory_. 

Tanner Linsley  

❓ **What should you do?** Consider an install-time cooldown (e.g. with `npm config set min-release-age=7` or [pnpm](https://pnpm.io/)'s `minimumReleaseAge`), as the packages were only compromised for 26 minutes. Plus, audit your GitHub Actions workflows for security issues with a tool like [zizmor](https://docs.zizmor.sh/).  [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/8c7fe4d2.jpeg)](https://sentry.io/resources/nextjs-may-workshop/?utm_source=javascriptweekly&utm_medium=paid-community&utm_campaign=nextjs-fy27q2-nextjsworkshop&utm_content=newsletter-primary-register) 

[Next.js Debugging Workshop: Logs, Tracing, Full Context](https://sentry.io/resources/nextjs-may-workshop/?utm_source=javascriptweekly&utm_medium=paid-community&utm_campaign=nextjs-fy27q2-nextjsworkshop&utm_content=newsletter-primary-register) — Stop jumping between tools to piece together a Next.js bug. Sentry's hands-on workshop shows you how to write logs that explain where, what, and why, then connect them to traces across client and Node runtimes. [Register today](https://sentry.io/resources/nextjs-may-workshop/?utm_source=javascriptweekly&utm_medium=paid-community&utm_campaign=nextjs-fy27q2-nextjsworkshop&utm_content=newsletter-primary-register). 

Sentry sponsor    

[Announcing Rolldown 1.0: The High Performance JS Bundler](https://voidzero.dev/posts/announcing-rolldown-1-0) — The Rust-based bundler built as the backbone for Vite 8 reaches a stable v1.0. You get huge performance gains, but with Rollup plugin API compatibility: it's 10–30x faster than Rollup, with early adopters reporting big drops in build time. 

The VoidZero Team   

**IN BRIEF:** 

- The [notes from Node.js's recent collaboration summit](https://nodejs.org/en/blog/events/collab-summit-2026-london) make for good reading if you want to see what the Node team is working on right now.
- Regarding Bun's experimental port to Rust (from Zig), Jarred Sumner says the now-960k LOC rewrite [passes 99.8% of Bun's pre-existing test suite.](https://x.com/jarredsumner/status/2053047748191232310)
- 🤖 A developer has [launched a challenge to port NetHack to JavaScript.](https://mazesofmenace.ai/) Can LLMs port the complex roguelike game _perfectly?_ So far, no, with [the leaderboard](https://mazesofmenace.ai/) showing a _transpiled_ version coming closest.
- Did you know [Firefox has a `$$$` helper](https://remysharp.com/2026/05/01/devtools-how-to-query-through-the-shadow-dom) for querying through the Shadow DOM?   

**RELEASES:** 

- [Jest 30.4.0](https://github.com/jestjs/jest/releases/tag/v30.4.0) – A strong release for the popular JavaScript testing framework as it improves ESM, Temporal and React 19 support.
- [Node 26.1 (Current)](https://nodejs.org/en/blog/release/v26.1.0) – Last week's [big Node 26 release](https://nodejs.org/en/blog/release/v26.0.0) may have had the Temporal API, but 26.1 adds (experimental) official FFI support. I did a writeup of what this means at the end of [last week's Node Weekly.](https://nodeweekly.com/issues/623)
- [Electron 42](https://www.electronjs.org/blog/electron-42-0) – Updates to Chromium 148/Node 24.15/V8 14.8 and no longer downloads the Electron binary in a `postinstall` script for added security.
- [Capacitor 9.0 Alpha 1](https://ionic.io/blog/capacitor-9-starts-here), [Playwright 1.60.0](https://github.com/microsoft/playwright/releases/tag/v1.60.0), [Mantine 9.2](https://github.com/mantinedev/mantine/releases/tag/9.2.0)  

📖 Articles and Videos  

[33 JavaScript Concepts](https://33jsconcepts.com/) — What began life as a [Medium article](https://medium.com/@steveandc/33-fundamentals-every-javascript-developer-should-know-13dd720a90d1) and turned into [a popular GitHub repo](https://github.com/leonardomso/33-js-concepts) is now a full site covering a wide array of JavaScript concepts, [even going beyond the 33](https://33jsconcepts.com/beyond/getting-started/overview). 

Leonardo Maldonado   

[9 Times the Web Platform Was Influenced by JavaScript Libraries](https://jadjoubran.io/blog/web-platform-influenced-by-libraries) — How various libraries like Lodash, Dojo and jQuery often did the “_R&D work in production_” for various features that eventually ended up in browser APIs. 

Jad Joubran   

[Easy and Rapid Azure Migrations. Azure Copilot Migration Agent](https://fandf.co/4uA0QFv) — Check out Microsoft’s [Introduction to Azure Copilot Agents free learning module](https://fandf.co/4uA0QFv) to learn more and [try it yourself](https://fandf.co/4uA0QFv). 

Microsoft Azure Copilot Migration Agent sponsor   

[From React to Web Components: A Migration That Saved 100 KB](https://evilmartians.com/chronicles/from-react-to-native-web-with-nanotags-a-migration-that-saved-100kb) — _“How I migrated a site from React to native Web Components, why that worked better than I expected, and how the patterns I used along the way grew into a small library called [nanotags](https://nanotags.psdcoder.dev/).”_ 

Pavel Grinchenko (Evil Martians)   

[Why Migrate to Valibot?](https://valibot.dev/blog/why-migrate-to-valibot/) — [Valibot](https://valibot.dev/) is a light, modular TypeScript schema validation library and an alternative to the likes of Zod. [v1.4.0](https://valibot.dev/blog/valibot-v1.4-release-notes/) just dropped, too. 

Fabian Hiller   

📄 [A Vanilla Routing Experiment](https://danielabaron.me/blog/a-vanilla-routing-experiment/) – A look at the tripping points when building client-side routing for a small site _without_ using a framework. Daniela Baron 

📄 [Preserving DOM Changes Across Live Reloads](https://kittygiraudel.com/2026/05/01/preserving-dom-changes-across-live-reloads/) Kitty Giraudel 

📄 [I Keep Tripping Over `true, false, true`](https://allthingssmitty.com/2026/05/11/i-keep-tripping-over-true-false-true/) Matt Smith 

📄 [Stop Using Yarn Classic](https://charpeni.com/blog/stop-using-yarn-classic) Nicolas Charpentier 

📄 [Introducing TanStack Form](https://frontendmasters.com/blog/introducing-tanstack-form/) Adam Rackis  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/aspuyiohodby5rhpai86.jpg)](https://zero-native.dev/)  

[zero-native: Build Desktop Apps with Zig + WebView](https://zero-native.dev/) — Vercel Labs’ entry into the [Neutralinojs](https://neutralino.js.org/)/Electron/Tauri space for building native HTML+JS desktop apps atop a Zig core and the system WebView _or_ Chromium. There are [examples](https://github.com/vercel-labs/zero-native/tree/main/examples) covering how to build vanilla, React, Svelte, and Vue apps on it. [GitHub repo.](https://github.com/vercel-labs/zero-native) 

Vercel   

[That API Call Takes 3 Seconds. It's Not the Network](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter) — It's the analytics query behind it. TimescaleDB extends Postgres so queries stay fast at scale. [$1000 credit to start](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter). 

Tiger Data (creators of TimescaleDB) sponsor   

[Wakaru: Pull Apart Minified JavaScript Bundles](https://github.com/pionxzh/wakaru) — A tool you can feed minified bundled code and get readable modules back, whether for recovering code, reverse-engineering, or security auditing. You can [try it online here.](https://wakaru.vercel.app/) 

Pionxzh   

[BlueJS: Compile JavaScript to Tiny Binaries](https://bluejs.dev) — An ahead-of-time compiler for JavaScript with QuickJS optionally embedded for dynamic features and package support. While _closed source_, the raw numbers are compelling (~5ms startup; 3.8MB peak memory use, and a GUI app in a 1.2MB binary). 

BlueJS  

💡 [PerryTS](https://www.perryts.com/) is another (open source) option in this space worth a look.  

- [pnpm 11.1](https://github.com/pnpm/pnpm/releases/tag/v11.1.0) – Supports a new `gh:` prefix for GitHub Packages, `pnpm bugs` opens a package's bug tracker in the browser, and `pnpm audit signatures` verifies ECDSA registry signatures against keys.
- [Astro 6.3](https://astro.build/blog/astro-630/) – Adds experimental support for advanced routing: control how requests flow through your app, with full support for frameworks like [Hono](https://hono.dev/).
- [Syncpack 15.0](https://github.com/JamieMason/syncpack/releases/tag/15.0.0) – Large JavaScript monorepo dependency version manager. Now with full support for pnpm and Bun catalogs.
- 📱 [Expo SDK 56 Beta](https://expo.dev/changelog/sdk-56-beta) – The popular React Native framework gets a speed boost and the Jetpack Compose and SwiftUI APIs go stable.
- [MDXEditor 4.0](https://mdxeditor.dev/) – Powerful Markdown editor React component.      

📰 Classifieds   

Flaky tests slowing down dev? [Meticulous](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=classified) gives engineers confidence to ship faster by autonomously testing every edge case of your web app. 

--- 

🔎 Detect, Highlight, Fix Accessibility - Test for WCAG & ARIA in the browser! Get [A11yInspect Pro](https://www.barrierbreak.com/gaad-2026-a11yinspect-pro/?utm_source=JSWNewsletter+JSW&utm_medium=Email&utm_campaign=GAAD26&utm_id=GAAD26) Free for 1 year - A developer friendly tool. [Join the waitlist](https://www.barrierbreak.com/gaad-2026-a11yinspect-pro/?utm_source=JSWNewsletter+JSW&utm_medium=Email&utm_campaign=GAAD26&utm_id=GAAD26).           

Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 

'JavaScript' is a trademark of Oracle Corporation in the US
We are not endorsed by or affiliated with Oracle. 

[Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom