The 'Shai-Hulud' npm Supply Chain Attack Rumbles On — Now named after a term for the sandworms of the Dune universe, the ongoing malicious supply chain attack affecting the npm ecosystem has grown in scale with hundreds of packages affected in an attempt to exfiltrate tokens and secrets from developers’ machines.

Pandya, van der Zee, and Brown (Socket)

FlexGrid by Wijmo: The Industry-Leading JavaScript Datagrid — A fast and flexible DataGrid for building modern web apps. Key features and virtualized rendering are included in the core grid module. Pick & choose special features to keep your app small. Built for JavaScript, extended to Angular, React, and Vue.

Wijmo From MESCIUS sponsor

⚖️ Deno Asks: 'Help Us Raise $200k to Free JavaScript from Oracle' — The term JavaScript(™) is actually an Oracle trademark, but Ryan Dahl and Deno are attempting to fight that and are raising funds to get through the all-important discovery phase of the cancellation petition.

Ryan Dahl (Deno)

Fetch Streams are Great, But Not for Measuring Upload/Download Progress — Fetch upload streams seem well-suited for tracking the progress of uploads, but as Jake notes “just because stuff is taken from the stream doesn’t mean it’s yet been sent over the network”. He also touches on an issue relating to measuring download progress using response streams.

Jake Archibald

Moving Off of TypeScript (We Love You, TypeScript) — An interesting tale from an engineering team that has decided to throw in the towel on its 2.5 million lines of TypeScript, instead migrating to .NET and C#. React will remain on their frontend, however.

Chander Ramesh

Secure Your Agentic Apps with Auth for GenAI — Secure your agentic apps with features like User Authentication for AI agents, Token Vault, and more with Auth0’s Auth for GenAI (exclusively in Developer Preview).

Auth0 sponsor

'React Won by Default – And It's Killing Frontend Innovation' — An opinionated React thought-piece that’s provoked much discussion this week by poking at the downsides and inertia caused by ‘the React-by-default mindset.’

Loren Stewart

npm-check-updates 18.2: Update package.json Dependencies to Latest Versions — That is, as opposed to the specified versions. Includes a handy -i interactive mode so you can look at potential upgrades and then opt in to them one by one. v18.2 adds a ‘cooldown’ feature to help protect against supply chain attacks by requiring package versions to be published at least the given number of days before considering them for upgrade.

Raine Revere

Expo SDK 54 Released: A Big One for React Native Developers — The Expo framework continues its rapid ascent in the world of React Native with precompiled React Native iOS builds (for much shorter build times), iOS 26 and Liquid Glass support, and the use of React Native 0.81 and React 19.1. The new Expo File System has also become stable.

Hughes and Vatne (Expo)

Ready to Increase Your Conversions? Get Started with Free Trials — Free Trials are now available through Clerk Billing. Stop building trial logic, cancellation flows, and upgrade paths.

Clerk sponsor

🦋 BlueSky Likes: Flexible Components for Displaying Bluesky Likes — Includes two custom element components: bluesky-likes and bluesky-likers to display the number of likes and a group of avatars of those who liked a post respectively. Live demo.

Lea Verou

Svedit: A Tiny Library for Building Rich Content Editors with Svelte — Enables you to model your content in JSON, render it with custom Svelte components, and edit directly in the layout. GitHub repo.

Michael Aufreiter