--- title: "Find better alternatives to npm packages" publication: "Node Weekly" issue: 627 published_at: "2026-06-04" canonical_url: "https://nodeweekly.com/issues/627" --- Plus TypeScript tips, a real-time collaboration backend, and Node.js Interactive is back. #​627 — June 4, 2026 [Read on the Web](https://nodeweekly.com/issues/627) Together with [![Memetria\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_600,h_145/e_make_transparent/co_white,e_outline:7/vvpdctzacmq3xehpvwps.png)](https://dashboard.memetria.com/nodeweekly/) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/petosggvikp84lziash3.jpg)](https://replacements.fyi/) [replacements.fyi: Find Replacements for npm Packages](https://replacements.fyi/) — Type in a package name and get suggestions of lighter alternatives or Node APIs and code snippets that do the same task. For example: `is-number` leads to a one-liner, `axios` turns into `fetch`, and `chalk` recommends `util.styleText`. A neat idea it’d be cool to see grow further. e18e [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/89cac34a.png)](https://dashboard.memetria.com/nodeweekly/) [Memetria K/V: Efficient Redis & Valkey Hosting](https://dashboard.memetria.com/nodeweekly/) — Memetria K/V hosts Redis OSS and Valkey for Node.js apps, featuring large key tracking and detailed analytics. Memetria sponsor [Node.js 26.3.0 (Current) Released](https://nodejs.org/en/blog/release/v26.3.0) — `Buffer.poolSize` default [is now 64 KB](https://github.com/nodejs/node/commit/a2a4b33dd8) for fewer allocations under heavy I/O, [`permission.drop()`](https://nodejs.org/api/permissions.html#permissiondropscope-reference) joins [the permissions model API](https://nodejs.org/api/permissions.html), and macOS Universal binaries are no longer guaranteed for future releases (the intention is to keep them _"for as long as practical"_). Antoine du Hamel **IN BRIEF:** - 🔒 **More supply chain attacks:** Earlier this week, [numerous Red Hat packages were targeted](https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages), and today, [a worm that hides within `binding.gyp` has been reported](https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/) (this is a notably uncommon vector). - 🇺🇸 [Node.js Interactive](https://openjsf.org/blog/nodejs-interactive-at-renderatl26) is returning as an event taking place alongside [RenderATL 2026](https://www.renderatl.com/) this August 12-13 in Atlanta, Georgia. - [VoidZero](https://voidzero.dev/), the company behind Vite, Vitest, Rolldown, Oxc, and Vite+, [is joining Cloudflare.](https://blog.cloudflare.com/voidzero-joins-cloudflare/) - 🔒 The Express team has [shipped `multiparty 4.3.0`](https://expressjs.com/en/blog/2026-05-31-security-releases/) to address three DoS vulnerabilities. 🤔 [How to Evaluate an npm Package](https://blog.gaborkoos.com/posts/2026-05-29-How-to-Evaluate-an-npm-Package-2026-Edition/) — If [replacements.fyi](https://replacements.fyi/) _(above)_ convinced you to switch packages, learn how to spot the red flags _before_ you `npm install` with this checklist for vetting packages — covering provenance attestation, install scripts, CI quality, and more. Gabor Koos [How Wasmer Used Codex to Build a Node.js Runtime](https://openai.com/index/wasmer/) — A case study from OpenAI on how the [Wasmer](https://wasmer.io/) team used OpenAI's _Codex_ agent to get Node workloads running inside a WebAssembly sandbox. (The resulting project is [the open-source _Edge.js_](https://wasmer.io/posts/edgejs-safe-nodejs-using-wasm-sandbox) which you can use now.) OpenAI 📊 [Benchmarking Node.js 24 vs 25 vs 26](https://www.repoflow.io/blog/node-js-24-vs-25-vs-26-complete-benchmark) — Earlier this year, RepoFlow [benchmarked every Node version](https://www.repoflow.io/blog/node-js-16-to-25-benchmarks-how-performance-evolved-over-time) between 16 and 25. Now they’re focusing on recent releases, but in all but one case, _there’s little difference._ RepoFlow [TypeScript Tips Everyone Should Know](https://github.com/AllThingsSmitty/typescript-tips-everyone-should-know) — A concise checklist of tips for safer, cleaner everyday code. Matt Smith 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/uytrsfosqutjel8ocvdg.jpg)](https://github.blog/changelog/2026-06-02-copilot-sdk-is-now-generally-available/) 🤖 [GitHub Copilot SDK Now Generally Available](https://github.blog/changelog/2026-06-02-copilot-sdk-is-now-generally-available/) — Available for several platforms, including Node, this SDK lets you wield the agentic engine behind Copilot in your own apps (coupled with your own custom-built tools) and it uses an existing Copilot subscription. The [getting started tutorial](https://docs.github.com/en/copilot/how-tos/copilot-sdk/getting-started) provides a good intro and [the cookbook](https://github.com/github/awesome-copilot/tree/main/cookbook/copilot-sdk) includes some sample apps. GitHub [How Node's diagnostics_channel Is Replacing APM Monkey-Patching](https://blog.sentry.io/fixing-javascript-observability/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=observability-fy27q2-evergreen&utm_content=newsletter-sponsored-link-javascript-blog-learnmore) — Every JS APM tool monkey-patches libraries. It breaks with ESM, bundlers, and non-Node runtimes. [Here's how to fix it](https://blog.sentry.io/fixing-javascript-observability/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=observability-fy27q2-evergreen&utm_content=newsletter-sponsored-link-javascript-blog-learnmore). Sentry sponsor [zod-hoist: A Babel Plugin to Hoist Zod Schema Definitions](https://github.com/gajus/babel-plugin-zod-hoist) — From the creator of [Slonik](https://github.com/gajus/slonik) comes an approach to make Zod validation much faster. Gajus Kuizinas [node-redis 6.0: The Official Node.js Driver for Redis](https://github.com/redis/node-redis/releases/tag/redis%406.0.0) — Coinciding with the release of [Redis 8.8](https://redis.io/blog/announcing-redis-8-8/), the Node driver adds support for 8.8’s new array commands, switches to the RESP3 protocol by default, and more. There’s [a migration guide](https://github.com/redis/node-redis/blob/redis@6.0.0/docs/v5-to-v6.md) for 5.x users. Redis [Structon: Random-Access Binary Encoding for JavaScript](https://www.harper.fast/resources/introducing-structon-random-access-binary-encoding-for-javas) — Encodes objects into a binary format you can read field-by-field, so you can pull individual values straight out of the buffer without deserializing whole records. Kris Zyp (Harper) [Hocuspocus 4: Add Real-Time Collaboration to Any App](https://tiptap.dev/docs/hocuspocus/getting-started/overview) — A real-time collaboration backend based on [Yjs](https://yjs.dev/) so you can quickly wire multi-user collaborative experiences into apps. It runs on Node, Bun, Deno, or Cloudflare Workers. Tiptap - [Axios 1.17](https://github.com/axios/axios) – The long-standing promise-based HTTP client adds HTTP zstd decompression on Node. - [pnpm 11.5](https://pnpm.io/blog/releases/11.5) – [Staged publishes are now recognized](https://socket.dev/blog/pnpm-11-5-adds-support-for-recognizing-npm-staged-publishes) in the trust scale. - [node-oracledb 7.0](https://medium.com/@sharad-chandran/launching-node-oracledb-7-0-aad650374909) – Official Node.js driver for Oracle Database. - [node-libcurl 5.1](https://github.com/JCMais/node-libcurl) – `libcurl` bindings for Node. **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).