--- title: "Should we rewrite Node.js in Rust?" publication: "Node Weekly" issue: 625 published_at: "2026-05-21" canonical_url: "https://nodeweekly.com/issues/625" --- Plus the npm supply chain attacks rumble on, Node 26.2, and Express gets a fresh lick of paint. #​625 — May 21, 2026 [Read on the Web](https://nodeweekly.com/issues/625) Together with [![Frontend Masters logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_300,h_70/e_make_transparent/co_white,e_outline:5/nk0tfdvalivacz8rw7rt.png)](https://frontendmasters.com/courses/ai-engineering/?utm_source=email&utm_medium=nodeweekly&utm_content=aiengineering) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/fsvwj9zvfpmdmnocruui.jpg)](https://expressjs.com/en/blog/2026-05-18-a-new-look-for-express/) [A Fresh Chapter and New Look for Express](https://expressjs.com/en/blog/2026-05-18-a-new-look-for-express/) — For a while, Node’s long-standing web framework, _Express.js_, was looking a bit stale and projects like [Fastify](https://fastify.dev/) were beginning to carry the torch, but [a major reboot that began in 2024](https://expressjs.com/en/blog/2025-01-09-rewind-2024-triumphs-and-2025-vision/) brought Express back to the fore. Now Express’s brand, website, and [docs](https://expressjs.com/en/5x/guide/routing/) have time-travelled to 2026 too. Sebastian Beltran [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/b7435692.png)](https://frontendmasters.com/courses/ai-engineering/?utm_source=email&utm_medium=nodeweekly&utm_content=aiengineering) [AI Engineering Fundamentals with Scott Moss of Netflix](https://frontendmasters.com/courses/ai-engineering/?utm_source=email&utm_medium=nodeweekly&utm_content=aiengineering) — Learn to build reliable AI features. Build an AI-assisted Excalidraw app, set up eval harnesses, master context engineering, and ship agents that actually work. Frontend Masters sponsor [Introducing Staged Publishing for npm Packages](https://docs.npmjs.com/staged-publishing) — Several months after first being teased, npm has released its new ‘staged publishing’ model that provides a review period before packages go live (as part of yesterday’s [npm 11.15.0 release](https://github.com/npm/cli/releases/tag/v11.15.0)). The npm Project 💡 A [prerelease of npm 12.0](https://github.com/npm/cli/releases/tag/v12.0.0-pre.0.0) has also just been released. **IN BRIEF:** - 🔒 GitHub's Jamie Magee has [proposed that `npm` make install scripts opt-in only by default](https://github.com/npm/rfcs/pull/868) to help mitigate problems increasingly caused by malevolent `postinstall` and similar scripts. - 🔒 [Shai Hulud struck again earlier this week](https://socket.dev/blog/antv-packages-compromised), affecting hundreds of packages. Meanwhile, [`node-ipc` was also infected](https://socket.dev/blog/node-ipc-package-compromised) with a credentials stealer. - [Deno 2.8 is being teased](https://bsky.app/profile/deno.land/post/3mm6clkq5uc22) to be released this week with huge Node.js compatibility improvements, `import defer`, and TypeScript 6.0.3 support. [Node.js 26.2.0 (Current) Released](https://nodejs.org/en/blog/release/v26.2.0) — A modest release compared to [v26](https://nodejs.org/en/blog/release/v26.0.0) (Temporal) and [v26.1](https://nodejs.org/en/blog/release/v26.1.0) (`node:ffi`), but `stream.compose` is now marked as stable and `fs.Stats`/`BigIntStats` now support `Temporal.Instant`. Antoine du Hamel [How Node.js and V8 Keep Each Other Working](https://joyeecheung.github.io/blog/2026/05/18/how-nodejs-and-v8-keep-each-other-working/) — A behind-the-scenes look at how Node stays in sync with the V8 engine. Joyee Cheung [Build Durable AI Agents That Won’t Break in Production (Webinar)](https://orkes.io/webinars/the-4-layer-production-stack-every-ai-agent-needs?utm_campaign=Node%20weekly&utm_source=Newsletter&utm_medium=email) — Learn the open-source 4-layer stack and run durable AI agents with Agentspan across LangGraph, OpenAI, and Google SDKs. Orkes sponsor 📄 [Hardening TanStack After the npm Compromise](https://tanstack.com/blog/incident-followup) – What TanStack is doing to improve supply chain security after [last week’s attack.](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem) The TanStack Team 📄 [Optimizing Build Times by Migrating from Webpack to Rspack](https://engineeringblog.yelp.com/2026/05/optimizing-our-build-times-by-migrating-from-webpack-to-rspack.html) Benson Pan (Yelp) 📄 [Building Automatic, Contextual Clinical Trial Audit Logging in Postgres Without Triggers](https://runharbor.com/blog/2026-05-18-building-automatic-contextual-clinical-trial-audit-logging-in-postgres-without-triggers) – Using Drizzle, specifically. Nathan Leung (Harbor) 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/wmetd6i6esxnhgrtv4s7.jpg)](https://nodejs.org/en/blog/migrations/axios-to-fetch) [An Official Codemod to Migrate from Axios to `fetch`](https://nodejs.org/en/blog/migrations/axios-to-fetch) — A [codemod](https://nodejs.org/learn/getting-started/userland-migrations) (used via `npx codemod`) that transforms code using Axios to leverage the WHATWG Fetch API, which is now natively available in Node.js. For some reason they don’t link to it in the post, but [it’s here](https://app.codemod.com/registry/@nodejs/axios-to-whatwg-fetch) if you want to try it out (and [here’s the underlying code](https://github.com/nodejs/userland-migrations/blob/main/recipes/axios-to-whatwg-fetch/src/workflow.ts)). Augustin Mauroy [TypeORM 1.0: The DataMapper and ActiveRecord ORM](https://typeorm.io/docs/releases/1.0/release-notes/) — The popular TypeScript-first ORM that supports all major relational databases has reached 1.0 after years on 0.3.x, bringing cleanup and modernization work, `INSERT INTO ... SELECT` support, cross-driver transaction isolation levels, and smoother PostgreSQL enum migrations. TypeORM Team [Kanel 4.0: Generate TypeScript Types from Postgres](https://kristiandupont.github.io/kanel/) — It inspects your database and outputs code you can add to a TypeScript project for use with something like Knex, Zod or Kysely (it has official extensions for each). [GitHub repo.](https://github.com/kristiandupont/kanel) Kristian Dupont - [ESLint 10.4](https://eslint.org/blog/2026/05/eslint-v10.4.0-released/) – Adds a `includeIgnoreFile()` helper for including patterns from `.gitignore` files and other files with gitignore-style patterns. - [pnpm 11.2](https://github.com/pnpm/pnpm) – The efficient package manager adds an opt-in experiment for using a Rust powered install engine. - [Vavite 7.0](https://github.com/cyco130/vavite) – Bring the power of Vite to building server-side apps, complete with Hot Module Replacement. - 🤖 [Adonis MCP 1.0](https://adonis-mcp.jrmc.dev/) – Enable AI-powered interactions on [AdonisJS](https://adonisjs.com/) apps. ([GitHub repo.](https://github.com/batosai/adonis-mcp)) - [Joist 2.2](https://joist-orm.io/) – Opinionated ORM for TypeScript, Node, and Postgres with schema-driven code generation. - [MikroORM 7.1](https://mikro-orm.io/blog/mikro-orm-7-1-released) – Another big release for the popular TypeScript ORM. 📰 Classifieds Autoscaling that doesn’t suck. [Try Judoscale](https://judoscale.com/node?utm_source=node-weekly&utm_medium=newsletter&utm_campaign=try-judoscale&utm_content=doesnt-suck) and see what all the fuss is about. --- ⚡[Clerk API Keys are now GA](https://go.clerk.com/0aQAcGu). Let your users create credentials that delegate access to your app's API — verify server-side, revoke instantly. 1K creations and 100K verifications free per month. 📢 Elsewhere in the ecosystem [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/pjnzwjwur1bhozwghxb3.jpg)](https://www.youtube.com/watch?v=nrdDmR1inl4) - **😱 Bun's Zig-to-Rust porting saga continues, but what about Node...?** The [Rust-based rewrite of Bun has been merged](https://github.com/oven-sh/bun/pull/30412), though there are [questions over the quality](https://github.com/oven-sh/bun/issues/30719) of the AI-ported code. Matteo Collina and Luca Maraschi got together to [▶️ discuss the story and speculate whether Node could follow...](https://www.youtube.com/watch?v=nrdDmR1inl4) - **🐝 Buzzin' through $5M.** [Wasp](https://wasp.sh/) is a Rails-like framework for Node, React and Prisma, but it started life as a custom programming language of its own. Founder Matija Sosic tells the story [of why inventing a new language was an (expensive) mistake](https://wasp.sh/blog/2026/05/13/new-language-for-web-dev-was-a-mistake) and how they landed on Node. - **🕹️ Doom in Node.js via FFI.** I knew something cool would come of [Node v26.1](https://nodejs.org/en/blog/release/v26.1.0)'s initial `node:ffi` support, and here it is: [Destino lets you play Doom in your terminal](https://blog.platformatic.dev/destino-doom-terminal-nodejs-ffi) by calling out to [doomgeneric](https://github.com/ozkl/doomgeneric) and wrapping it with [OpenTUI](https://github.com/anomalyco/opentui). **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).