---
title: "How to vet an npm package in 2026"
publication: "JavaScript Weekly"
issue: 788
published_at: "2026-06-02"
canonical_url: "https://javascriptweekly.com/issues/788"
---

Plus tracking SSD activity from JavaScript, Ember 7.0, Astro 6.4, and intentionally blocking rendering with JavaScript?        

#​788 — June 2, 2026 

[Read on the Web](https://javascriptweekly.com/issues/788)  

Together with [![Meticulous\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_2600,h_373/e_make_transparent/co_white,e_outline:30/s65exulzcd60xe2r5nyk.png)](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=primary)   

JavaScript Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/y0qlucgypimbs46gwzyu.jpg)](https://tiptap.dev/docs/hocuspocus/getting-started/overview)  

[Hocuspocus 4: Add Real-Time Collaboration to Any App](https://tiptap.dev/docs/hocuspocus/getting-started/overview) — A plug-and-play real-time collaboration backend based on [Yjs](https://yjs.dev/) so you can quickly and safely wire up multi-user collaborative experiences into a JavaScript app. It runs on Node, Bun, Deno, or Cloudflare Workers. [GitHub repo.](https://github.com/ueberdosis/hocuspocus) 

Tiptap   [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/ca87702e.png)](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=primary) 

[Still Writing Tests Manually? Meticulous AI Is Here](https://www.meticulous.ai/?utm_source=jsweekly&utm_medium=newsletter&utm_campaign=26q2&utm_content=primary) — Notion, Dropbox, Wiz and LaunchDarkly now use a testing paradigm they can’t work without. Built by former Palantir engineers, Meticulous automatically creates an evolving suite of E2E UI tests, delivering exhaustive coverage with no developer effort. 

Meticulous sponsor   

[How to Evaluate an npm Package: 2026 Edition](https://blog.gaborkoos.com/posts/2026-05-29-How-to-Evaluate-an-npm-Package-2026-Edition/) — A practical checklist for vetting packages beyond star counts, covering provenance attestation, install scripts, CI quality, and maintainer responsiveness. Learn to spot the red flags _before_ you `npm install`. 

Gabor Koos   

**IN BRIEF:** 

- 🕒 The popular [date-fns](https://date-fns.org/) date utility library is [preparing for a `Temporal` shaped future](https://date-fns.org/you-dont-need-date-fns) and becoming a "Temporal-first library". For now, a much leaner [v4.4](https://github.com/date-fns/date-fns/releases/tag/v4.4.0) is available, and [v5.0 just entered alpha](https://github.com/date-fns/date-fns/releases/tag/v5.0.0-alpha.0).
- 🔒 In the [latest surfacing](https://socket.dev/blog/mini-shai-hulud-campaign-hits-red-hat-cloud-services-npm-packages) of Shai-Hulud, [dozens of Red Hat npm packages have been backdoored](https://arstechnica.com/security/2026/06/dozens-of-red-hat-packages-backdoored-through-its-offical-npm-channel/).
- [npm 11.16.0 has shipped](https://github.com/npm/cli/releases/tag/v11.16.0) with initial (advisory warning only) support for an _opt-in_ install-script policy using `allowScripts`. [More details here.](https://github.com/npm/cli/pull/9360)
- The Svelte team presents [its latest monthly update.](https://svelte.dev/blog/whats-new-in-svelte-june-2026)   

**RELEASES:** 

- [Ember 7.0](https://blog.emberjs.com/ember-released-7-0/) – A major release for the long-standing framework to remove deprecated features. This post rounds up everything new since 6.0.
- [Node.js 26.3.0 (Current)](https://nodejs.org/en/blog/release/v26.3.0) – npm is upgraded to [11.16.0](https://github.com/npm/cli/releases/tag/v11.16.0), macOS x64 [gets demoted](https://github.com/nodejs/node/pull/63055) to a tier 2 platform, and QUIC gets a big batch of improvements.
- [Astro 6.4](https://astro.build/blog/astro-640/) – The web framework adds a pluggable Markdown pipeline, a Rust-based Markdown processor, and helpers for advanced routing on Cloudflare.
- [pnpm 11.5.0](https://github.com/pnpm/pnpm/releases/tag/v11.5.0)/[11.5.1](https://github.com/pnpm/pnpm/releases/tag/v11.5.1), [ESLint 10.4.1](https://eslint.org/blog/2026/05/eslint-v10.4.1-released/), [Angular 22 RC3](https://github.com/angular/angular/releases/tag/v22.0.0-rc.3)  

📖 Articles and Videos  

🤖 [Using AI to Write Better Code More Slowly](https://nolanlawson.com/2026/05/25/using-ai-to-write-better-code-more-slowly/) — A prolific JavaScript developer says LLMs aren’t just for pumping out bad code quickly, they can indeed help you write higher quality code more _slowly_. 

Nolan Lawson   

[TypeScript Tips Everyone Should Know](https://github.com/AllThingsSmitty/typescript-tips-everyone-should-know) — A concise set of tips for safer and cleaner code, as well as a reminder that while TypeScript can improve correctness, it doesn't guarantee good architecture or eliminate runtime bugs. 

Matt Smith   

[Your Partition Scheme Made Sense. Then the Data Got Big](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter) — TimescaleDB extends Postgres so analytics queries stay fast at scale. No pipeline, no second database. [$1000 credit](https://www.tigerdata.com/go/trial?utm_source=content-syndication&utm_medium=referral&utm_campaign=javascript-weekly-newsletter). 

Tiger Data (creators of TimescaleDB) sponsor   

[_Intentionally_ Blocking Rendering with JavaScript](https://www.jayfreestone.com/writing/intentional-render-blocking-javascript/) — _"Sometimes an inline render-blocking script is a small price to pay for avoiding aggressive layout shifts."_ 

Jay Freestone   

[Why Does tsgo Use So Much Memory?](https://zackoverflow.dev/writing/why-does-tsgo-use-so-much-memory) — A look into the Go-powered TypeScript 7 compiler and why it can chew through gigabytes on a large project. 

Zack Radisic   

📄 [CSS vs. JavaScript for Web Animations](https://www.joshwcomeau.com/animation/css-vs-javascript/) – Underlying performance differences and guidance on when to pick which approach. Josh W. Comeau 

📄 [Your Recursion is Lying to You](https://blog.gaborkoos.com/posts/2026-05-09-Your-Recursion-Is-Lying-to-You/) – ES2015 specified tail call optimization, but most engines in 2026 don’t support it. Gabor Koos 

📄 [How We Cut Build Times by Two-Thirds by Deleting Our CMS](https://blog.sentry.io/cut-build-times-delete-cms/) – The story of Sentry's Gatsby to Astro migration. Eli Lennox (Sentry) 

📄 [Creating a VS Code Agent Hook to Respond to File Changes](https://humanwhocodes.com/blog/2026/05/vscode-agent-hooks/) Nicholas C. Zakas  

🛠 Code & Tools 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/zotseriykxd9twkdybuq.jpg)](https://plotly.com/javascript/)  

📊 [Plotly 3.6: The Declarative Graphing Library](https://plotly.com/javascript/) — A long-standing library, also widely used in the Python and R ecosystems, that offers over 50 visualization types, from basic charts and graphs to maps, plots, and heatmaps. 

Plotly, Inc.   

[Expo UI Is Stable. Real SwiftUI and Compose from JS](https://try.expo.dev/react-status-ui) — One import. SwiftUI on iOS, Jetpack Compose on Android. Plus native drop-in replacements for 7 community packages. 

Expo sponsor   

[Component Party: A Rosetta Stone of UI Libraries](https://component-party.dev/?f=react-vue3) — A side-by-side code snippet comparison of frameworks including React, Vue, Svelte, Angular, Ember, and more obscure options. Recent updates have extended Angular and Svelte coverage, plus added Ripple and Ember Polaris to the mix. 

Mathieu Schimmerling   

🎉 [tsParticles 4: A Particle Engine for Web Effects](https://particles.js.org/) — If you want a confetti cannon, fireworks, [ribbons](https://ribbons.js.org/), fireflies, snow, or similar effects on your pages, this is for you. Supports all major frameworks and vanilla JS. You can see some [live demos here.](https://particles.js.org/playground/presets) 

Matteo Bruni   

- 📝 [officeParser 7.1](https://github.com/harshankur/officeParser/releases/tag/v7.1.0) – Parse 'office' files (e.g. `docx`, `pptx`, `xlsx`, `odt`) into an AST. The [in-browser demo](https://officeparser.harshankur.com/#visualizer) shows off what's returned.
- 🔎 [Fuse.js 7.4](https://github.com/krisk/Fuse/releases/tag/v7.4.0) – JavaScript fuzzy-search library. v7.4 adds support for parallel search powered by Web Workers. ([Homepage](https://www.fusejs.io/))
- [ESLint You Might Not Need An Effect 1.0](https://github.com/nickjvandyke/eslint-plugin-react-you-might-not-need-an-effect) – ESLint/Oxlint plugin to catch when [you might not need an Effect](https://react.dev/learn/you-might-not-need-an-effect) in React.
- [PGlite 0.5](https://pglite.dev/) – Run a Postgres database locally in WASM with reactivity and live sync. v0.5 upgrades to Postgres 18.3.
- [TinyBase 8.4](https://tinybase.org/guides/releases/) – A reactive data store and sync engine for local-first apps. Now with full [SolidJS](https://www.solidjs.com/) support.
- [Sugar High 1.2](https://sugar-high.vercel.app/) – 1KB syntax highlighter for JavaScript and JSX.
- [Mantine 9.3](https://mantine.dev/changelog/9-3-0/) – Popular, extensive React component suite.      

📰 Classifieds   

🚀 [Handsontable's](https://eu1.hubs.ly/H0vJ7St0) 342K-line JS→TS migration is ready — best-in-class docs so you can build faster, with confidence. 

--- 

⚡ Add production-ready auth to Next.js in minutes. Run clerk init, configure from the terminal, skip the dashboard:[clerk.com/cli](https://go.clerk.com/JGkZ4li). 

--- 

🤖 [A fleet of coding agents that ship real PRs](https://agentfield.ai/github/swe-af/?utm_source=javascript&utm_medium=newsletter&utm_campaign=javascript-260602&utm_id=javascript-260602-github-swe-cta&utm_content=github-swe-cta). SWE-AF orchestrates Claude Code, Codex & Gemini into reviewed, production-grade pull requests - not demos.    

📢 Elsewhere in the ecosystem 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/jduog0br5xg7lo2ctcyn.jpg)](https://www.youtube.com/watch?v=K-Xv8D8NjTk)  

- Programming language legend [▶️ Anders Hejlsberg was on _The Pragmatic Engineer_](https://www.youtube.com/watch?v=K-Xv8D8NjTk) talking about his background, work on TypeScript, JavaScript's strengths and weaknesses, and how he uses AI.
- Kyle Simpson (of [YDKJS](https://github.com/getify/you-dont-know-js) fame) got in touch minutes before we hit send to let us know about [@gql-x/Composer](https://github.com/gql-x/Composer), a new library he's working on that's a JavaScript DSL for dynamically composing GraphQL query strings.
- A new way for sites to sneakily track users with JavaScript has been demonstrated. It involves [analyzing SSD usage by using the Origin Private File System feature.](https://arstechnica.com/security/2026/05/websites-have-a-new-way-to-spy-on-visitors-analyzing-their-ssd-activity/)
- 🤖 [The results of the _State of Web Dev AI_ 2026 survey](https://2026.stateofai.dev/en-US) are ready to enjoy with stats on AI use from over 7,000 developers.         

Published by [Cooperpress](https://cooperpress.com/) and edited by [Peter Cooper](https://twitter.com/cooperx86) 

'JavaScript' is a trademark of Oracle Corporation in the US
We are not endorsed by or affiliated with Oracle. 

[Change your email address](https://javascriptweekly.com/edit_subscription/*|UID|*) or [stop getting this newsletter](https://javascriptweekly.com/leave/*|UID|*). 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom