#602 — November 25, 2025 |
|
![]() |
|
|
How a Summer in Abruzzo Helped Bring Type Stripping to Node.js — Node.js TSC member and committer Marco tells the personal tale of what it took to bring type stripping (now considered stable) to Node. It’s neat to get the back story. He’s now working on a new experimental feature: Marco Ippolito |
Tiger Data Taught AI to Write Real Postgres Code. Try it Today. — Tiger Data taught AI how to write idiomatic Postgres and open-sourced it. pg-aiguide brings real DB expertise to Claude Code, or any other MCP-enabled tool. Tiger Data sponsor |
|
⚠️ Shai Hulud 2.0: The Widespread npm Supply Chain Attack is Back — The big story this week is an evolution of a previous story we’ve covered about a 'worm' that spreads through npm packages. GitLab does a good job of explaining what’s going on: an infected package gets installed then executes a malicious payload which exfiltrates GitHub, npm, and other credentials, then infects and publishes yet more packages. Abeles and Henriksen (GitLab) |
💡 Numerous sources have written about this latest wave of attacks including Wiz, Snyk, Socket, Aikido and HelixGuard. Corridor's Shai Hulud 2.0 Detector can also be used to scan a |
|
IN BRIEF:
|
|
📄 An Experiment in Making TypeScript Immutable-by-Default – “I wondered: is it possible to make TypeScript values immutable by default?” Evan Hahn 📄 A Comprehensive Guide to Error Handling in Node Ayooluwa Isaiah (Honeybadger) |
🛠 Code & Tools |
|
|
Gluegun: A Toolkit for Building Node-Powered CLIs — For building CLI apps with many features available 'out of the box', including templating, sub-command support, colorful output, argument parsing, etc. Infinite Red, Inc. |
|
tshy 3.1: TypeScript HYbridizer — A tool by Isaac Z. Schlueter for building hybrid modules that Just Work™ in both ESM and CommonJS contexts, if you’re not quite ready to go ESM only. Isaac Z. Schlueter |
|
BoldSign eSignature API & SDK — Built for Developers, Easy to Integrate — ✍️ Ship secure e-signatures in your app in minutes with the BoldSign SDK & API. Get your free API key and start testing today. BoldSign sponsor |
|
(*.js) Glob 13: Match Files Using Shell-Style Patterns — “The most correct and second fastest glob implementation in JavaScript.” Isaac Z. Schlueter |
|
is-online 12.0: Check if the Internet Connection Is Up — Works in both Node and the browser and uses several approaches to check if the Internet is really available. Sindre Sorhus |
|
open v11.0: Open URLs, Files, Executables, etc. Cross-Platform — Designed for use in command line tools and scripts, Sindre Sorhus |
|
jsonld.js v9.0: A JSON-LD Processor and API Implementation — JSON-LD (JSON for Linking Data) is a JSON-based format used to represent objects on the Web in a way that’s easy for code to read. Digital Bazaar, Inc. |
|
📢 Elsewhere in the ecosystem |
|
A roundup of some other interesting stories in the broader landscape: |
|
|



