#​602 — November 25, 2025

Read on the Web

Together with  Tiger Data logo
Node.js Weekly

How a Summer in Abruzzo Helped Bring Type Stripping to Node.js — Node.js TSC member and committer Marco tells the personal tale of what it took to bring type stripping (now considered stable) to Node. It’s neat to get the back story. He’s now working on a new experimental feature: --experimental-config-file

Marco Ippolito

Tiger Data Taught AI to Write Real Postgres Code. Try it Today. — Tiger Data taught AI how to write idiomatic Postgres and open-sourced it. pg-aiguide brings real DB expertise to Claude Code, or any other MCP-enabled tool.

Tiger Data sponsor

⚠️ Shai Hulud 2.0: The Widespread npm Supply Chain Attack is Back — The big story this week is an evolution of a previous story we’ve covered about a 'worm' that spreads through npm packages. GitLab does a good job of explaining what’s going on: an infected package gets installed then executes a malicious payload which exfiltrates GitHub, npm, and other credentials, then infects and publishes yet more packages.

Abeles and Henriksen (GitLab)

💡 Numerous sources have written about this latest wave of attacks including Wiz, Snyk, Socket, Aikido and HelixGuard. Corridor's Shai Hulud 2.0 Detector can also be used to scan a package.json file for known affected packages.

IN BRIEF:

📄 An Experiment in Making TypeScript Immutable-by-Default“I wondered: is it possible to make TypeScript values immutable by default?” Evan Hahn

📄 A Comprehensive Guide to Error Handling in Node Ayooluwa Isaiah (Honeybadger)

🛠 Code & Tools

Gluegun: A Toolkit for Building Node-Powered CLIs — For building CLI apps with many features available 'out of the box', including templating, sub-command support, colorful output, argument parsing, etc.

Infinite Red, Inc.

tshy 3.1: TypeScript HYbridizer — A tool by Isaac Z. Schlueter for building hybrid modules that Just Work™ in both ESM and CommonJS contexts, if you’re not quite ready to go ESM only.

Isaac Z. Schlueter

BoldSign eSignature API & SDK — Built for Developers, Easy to Integrate — ✍️ Ship secure e-signatures in your app in minutes with the BoldSign SDK & API. Get your free API key and start testing today.

BoldSign sponsor

(*.js) Glob 13: Match Files Using Shell-Style Patterns“The most correct and second fastest glob implementation in JavaScript.”

Isaac Z. Schlueter

is-online 12.0: Check if the Internet Connection Is Up — Works in both Node and the browser and uses several approaches to check if the Internet is really available.

Sindre Sorhus

open v11.0: Open URLs, Files, Executables, etc. Cross-Platform — Designed for use in command line tools and scripts, open acts similarly to macOS’s terminal namesake: open

Sindre Sorhus

jsonld.js v9.0: A JSON-LD Processor and API ImplementationJSON-LD (JSON for Linking Data) is a JSON-based format used to represent objects on the Web in a way that’s easy for code to read.

Digital Bazaar, Inc.

  • Prisma 7.0 – Popular ORM for Node.js and TypeScript. The Rust-free Prisma Client is now the default.

  • Mongoose 9.0 – Popular MongoDB object modeling library.

  • 🖼️ exiftool-vendored.js v33.4 – Fast, cross-platform Node.js access to ExifTool for extracting metadata from photos.

  • 🔎 Node File Trace (NFT) 1.1 – A tool from Vercel for determining exactly which files are necessary for an app to run.

  • Link Preview JS 4.0 – Extract Web link information from a URL using OpenGraph tags.

  • node-redis 5.10 – The Redis/Valkey client library adds support for some new commands.

  • cron-schedule 6.0 – Zero-dependency cron parser and scheduler.

  • Wasp 0.19Wasp is a Rails-like framework built on Node, React & Prisma.

  • pnpm 10.23 – Fast, space efficient package manager.

📢  Elsewhere in the ecosystem

A roundup of some other interesting stories in the broader landscape:

Photo used with the kind permission of Rob Palmer