--- title: "Social engineering attacks target high-impact Node.js maintainers" publication: "Node Weekly" issue: 619 published_at: "2026-04-09" canonical_url: "https://nodeweekly.com/issues/619" --- Plus text-to-speech with a 3MB model, using the Web Audio API from Node, and a refresher of modern JavaScript features. #​619 — April 9, 2026 [Read on the Web](https://nodeweekly.com/issues/619) Together with [![Microsoft logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_280,h_60/e_make_transparent/co_white,e_outline:7/om9hjsmudy5lsvba59eb.png)](https://posetteconf.com/2026/schedule/) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/dxux2uvcy9unbbysurgu.jpg)](https://github.com/axios/axios/issues/10636) [A Post-Mortem of the Axios Compromise](https://github.com/axios/axios/issues/10636) — The Axios team has shared a detailed post-mortem of [the recent supply chain compromise](https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan) where a trojan was pulled in as a malicious dependency. The attack was well planned and involved [a sophisticated bit of social engineering.](https://simonwillison.net/2026/Apr/3/supply-chain-social-engineering/) Jason Saayman / axios ⚠️ Axios isn't the only target. Sarah Gooding reports on [ongoing attempts to socially engineer 'high-impact Node.js maintainers.'](https://socket.dev/blog/attackers-hunting-high-impact-nodejs-maintainers) **It's worth being aware of these techniques if you maintain any public npm packages.** [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/3b00cadd.png)](https://posetteconf.com/2026/schedule/) [You Don’t Have To Attend All 44 Postgres Talks](https://posetteconf.com/2026/schedule/) — POSETTE: An Event for Postgres 2026 is a free & virtual developer event on 16-18 Jun. All 44 talks stream live & will be available later. Join live to take part in discussions with speakers & attendees. [Check out the schedule and mark your calendar.](https://posetteconf.com/2026/schedule/) Microsoft | AMD sponsor [You Can't Cancel a Promise (Except Sometimes You Can)](https://www.inngest.com/blog/hanging-promises-for-control-flow) — You can’t cancel a promise, but you can halt an async function by making it `await` a promise that never resolves. The function silently stops, and GC cleans up after it. It’s not just a trick; Inngest uses it in production to interrupt long-running workflow functions. Aaron Harper (Inngest) **IN BRIEF:** - Google's compilers team has [proposed a high-level IR for JavaScript](https://discourse.llvm.org/t/rfc-jsir-a-high-level-ir-for-javascript/90456) and shared a tool ([JSIR](https://github.com/google/jsir)) it's already using internally to take advantage of it for analysis and source-to-source transformation. - Microsoft has announced the [end of support for Node 20.x](https://devblogs.microsoft.com/azure-sdk/announcing-the-end-of-support-for-node-js-20-x-in-the-azure-sdk-for-javascript/) in the _Azure SDK for JavaScript._ - [npm trusted publishing now supports CircleCI](https://github.blog/changelog/2026-04-06-npm-trusted-publishing-now-supports-circleci/) as an OIDC provider. - 🎤 [A 50-minute chat](https://www.igalia.com/chats/npmxyz) (with transcript) from two of the developers behind the [npmx project](https://npmx.dev/) — an increasingly popular way to browse the npm registry. [Node's Security Bug Bounty Program Paused Due to Loss of Funding](https://nodejs.org/en/blog/announcements/discontinuing-security-bug-bounties) — Since 2016, the Node.js project has offered bounties for qualifying security vulnerability reports. This was funded by the _Internet Bug Bounty_ program which is [on hiatus](https://hackerone.com/ibb?type=team) as it figures out its role in an AI-assisted landscape. Reports can still be made, but with no monetary reward. The Node.js Project [tsdown Can Now Generate Executable Files for Node Apps](https://tsdown.dev/options/exe) — [tsdown](https://tsdown.dev/), the library bundler from VoidZero (Evan You's company), now supports building standalone executables using Node's [Single Executable Applications (SEA)](https://nodejs.org/api/single-executable-applications.html) feature. VoidZero 📄 [Building a Runtime with QuickJS](https://healeycodes.com/building-a-runtime-with-quickjs) Andrew Healey 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/k2ny3ugmivzjsodk8pjo.jpg)](https://github.com/audiojs/web-audio-api) [web-audio-api: Use the Web Audio API from Node](https://github.com/audiojs/web-audio-api) — Get full [Web Audio API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Audio_API) support in Node and play audio on your machine or render it to file (and, yes, [Tone.js](https://tonejs.github.io/) works too). There are [lots of examples](https://github.com/audiojs/web-audio-api/tree/master/examples) to enjoy. v1.0/1.3 supports all 26 audio node types and has a 100% pass rate against the WPT test suite. Sébastien Piquemal 🗣️ [TinyTTS: English Text-to-Speech with a 3.4MB Model](https://github.com/tronghieuit/tiny-tts) — Fast text-to-speech on the CPU with a tiny 3MB model for both Node.js and Python. Has an AI-generated vibe, but it worked well when [I used it like this](https://gist.github.com/peterc/2cdb2ba30476858b5d2a9a041ddf884c). There’s a [demo on the Web](https://huggingface.co/spaces/backtracking/tiny-tts-demo) to hear what it sounds like. tronghieuit [Analytics Doesn't Need Its Own Infrastructure](https://www.tigerdata.com/timescaledb?utm_source=cooperpress&utm_medium=referral&utm_campaign=node-weekly-newsletter) — TimescaleDB extends Postgres so analytics runs on live data. Same connection, no pipeline, no second database. Start for free. Tiger Data (creators of TimescaleDB) sponsor [Marked.js 18.0: Fast Markdown Parser Library](https://marked.js.org/) — A low level Markdown compiler built for speed, available as both a client and server-side library. [The demo](https://marked.js.org/demo/) shows off the basics. v18 is a bug fix release that also bumps it up to TypeScript 6. [GitHub repo.](https://github.com/markedjs/marked) Christopher Jeffrey 🤖 [grammY: An Up-to-Date Telegram Bot Framework](https://grammy.dev/) — _“Make creating Telegram bots so simple you already know how to do it.”_ This week’s release supports the latest [Telegram Bot API 9.6.](https://core.telegram.org/bots/api#april-3-2026) [GitHub repo.](https://github.com/grammyjs/grammY) KnorpelSenf [tokenu: `du`-Like CLI Tool to Count Token Usage in Files and Directories](https://github.com/lirantal/tokenu/) — Could be useful to see if your codebase can fit entirely into a sensible context window, say. Liran Tal - [ky 2.0](https://github.com/sindresorhus/ky/releases/tag/v2.0.0) – Sindre Sorhus's popular, elegant HTTP client library that wraps `fetch` gets a big upgrade including setting a `totalTimeout` across all retries, and `baseURL` for standard URL resolution to make your calls even simpler. - [npm-check-updates 20.0](https://github.com/raineorshine/npm-check-updates/releases/tag/v20.0.0) – Upgrade `package.json` dependencies while preserving semantic versioning policies. Now supports cooldowns. - [ESLint 10.2](https://eslint.org/blog/2026/04/eslint-v10.2.0-released/) – Adds support for language-aware rules through a new `meta.languages`property. `Temporal` is now supported too. - [Ink 7.0](https://github.com/vadimdemedes/ink/releases/tag/v7.0.0) – Build CLI/TUI apps using React. Now uses React 19, requires Node 22+, and adds a lot of useful hooks. - [content-disposition 1.1](https://github.com/jshttp/content-disposition) – Work with HTTP `Content-Disposition`headers. - [Orange ORM 5.3](https://github.com/alfateam/orange-orm) – The Node and TypeScript ORM adds MariaDB support. - [Axios 1.15.0](https://github.com/axios/axios) – The popular HTTP client adds Bun and Deno support. - [RedisSMQ 10.0](https://github.com/weyoss/redis-smq) – Simple Redis-backed message queue for Node. - [node-ical 0.26.0](https://github.com/jens-maus/node-ical) – iCalendar/ICS (RFC 5545) parsing library. - [Undici 8.0](https://github.com/nodejs/undici/releases) – HTTP/1.1 client written from scratch for Node. - [pnpm v11.0 Beta 8](https://github.com/pnpm/pnpm) 📰 Classifieds ⚡[Route product events to HubSpot, Salesforce, Slack & more in one API call.](https://meshes.io/go/start?utm_source=node_weekly&utm_medium=newsletter&utm_campaign=cls_20260409) Retries, fan-out, and delivery guarantees built in. --- Ship production AI. Land $200K–$950K. [Gauntlet's 10-week no-cost fellowship](https://gauntletai.com/apply?utm_source=newsletter&utm_medium=paid&utm_campaign=node_weekly&utm_content=april_9) builds the AI-first engineers hiring managers actually want. 📢 Elsewhere in the ecosystem - Keen to brush up your knowledge of modern JavaScript? Chris Coyier's [What To Know in JavaScript (2026 Edition)](https://frontendmasters.com/blog/what-to-know-in-javascript-2026-edition/) tours the latest language features, plus the state of the most popular runtimes and build tools. - 🤖 A developer discovered an npm package where the postinstall script [copied Markdown files into Claude Code's config.](https://www.reddit.com/r/node/comments/1sapgun/psa_npm_package_using_postinstall_to_inject/) While likely not malicious in this case, it's a vector ripe for abuse and worth knowing about. [Ignoring postinstall scripts](https://www.nodejs-security.com/blog/npm-ignore-scripts-best-practices-as-security-mitigation-for-malicious-packages) is a wise option, and something [pnpm v10+ does by default.](https://pnpm.io/supply-chain-security) - 🇷🇴 The popular [_JSHeroes_ conference](https://jsheroes.io/) is back this May 14-15 in Romania. - Engineers at the _Railway_ cloud hosting platform shared their story of [moving their frontend off Next.js to Vite and TanStack Router.](https://blog.railway.com/p/moving-railways-frontend-off-nextjs) - [Puru](https://github.com/dmop/puru) is a new project offering a channels-inspired 'Go-style concurrency' option in Node and Bun. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).