A Post-Mortem of the Axios Compromise — The Axios team has shared a detailed post-mortem of the recent supply chain compromise where a trojan was pulled in as a malicious dependency. The attack was well planned and involved a sophisticated bit of social engineering.

Jason Saayman / axios

You Don’t Have To Attend All 44 Postgres Talks — POSETTE: An Event for Postgres 2026 is a free & virtual developer event on 16-18 Jun. All 44 talks stream live & will be available later. Join live to take part in discussions with speakers & attendees. Check out the schedule and mark your calendar.

Microsoft | AMD sponsor

You Can't Cancel a Promise (Except Sometimes You Can) — You can’t cancel a promise, but you can halt an async function by making it await a promise that never resolves. The function silently stops, and GC cleans up after it. It’s not just a trick; Inngest uses it in production to interrupt long-running workflow functions.

Aaron Harper (Inngest)

Node's Security Bug Bounty Program Paused Due to Loss of Funding — Since 2016, the Node.js project has offered bounties for qualifying security vulnerability reports. This was funded by the Internet Bug Bounty program which is on hiatus as it figures out its role in an AI-assisted landscape. Reports can still be made, but with no monetary reward.

The Node.js Project

tsdown Can Now Generate Executable Files for Node Apps — tsdown, the library bundler from VoidZero (Evan You's company), now supports building standalone executables using Node's Single Executable Applications (SEA) feature.

VoidZero

web-audio-api: Use the Web Audio API from Node — Get full Web Audio API support in Node and play audio on your machine or render it to file (and, yes, Tone.js works too). There are lots of examples to enjoy. v1.0/1.3 supports all 26 audio node types and has a 100% pass rate against the WPT test suite.

Sébastien Piquemal

🗣️ TinyTTS: English Text-to-Speech with a 3.4MB Model — Fast text-to-speech on the CPU with a tiny 3MB model for both Node.js and Python. Has an AI-generated vibe, but it worked well when I used it like this. There’s a demo on the Web to hear what it sounds like.

tronghieuit

Analytics Doesn't Need Its Own Infrastructure — TimescaleDB extends Postgres so analytics runs on live data. Same connection, no pipeline, no second database. Start for free.

Tiger Data (creators of TimescaleDB) sponsor

Marked.js 18.0: Fast Markdown Parser Library — A low level Markdown compiler built for speed and available as both a client and server-side library. The demo shows off the basics. v18 is a bug fix release that also bumps it up to TypeScript 6. GitHub repo.

Christopher Jeffrey

🤖 grammY: An Up-to-Date Telegram Bot Framework — “Make creating Telegram bots so simple you already know how to do it.” This week’s release supports the latest Telegram Bot API 9.6. GitHub repo.

KnorpelSenf

tokenu: du-Like CLI Tool to Count Token Usage in Files and Directories — Could be useful to see if your codebase can fit entirely into a sensible context window, say.

Liran Tal