The Secure Way to Release an npm Package in 2026 — A practical guide to publishing npm packages more safely in 2026, written by someone who's released several popular packages (like postcss and nanoid). As well as showing how to use things like staged publishing and trusted publishing, he explains why and the security benefits of doing so.

Andrey Sitnik

Ship Node and Bun Apps in Minutes — Link your repo and Render takes it from there, handling every build, deploy, and SSL cert. Loop in your agent with official Render /plugins for Codex and Claude Code. Start free and scale from there.

Render sponsor

npm to Scan Every Package For Malware at Publish Time — The npm registry is beginning to scan packages at publish time, meaning new versions can take several minutes to become installable, and could be held or blocked.

GitHub

Check Out Node's New API Documentation Preview — Node's official API docs have been getting redesigned (now sharing a design system with nodejs.org itself) and have a new built-in search feature. You're invited to try the preview here and report what breaks.

Guilherme Araújo (Node.js Team)

How GitHub Is Disrupting Supply Chain Attacks on npm and Actions — Separate to the scanning news above, GitHub's team explains recent npm and Actions changes designed to mitigate supply chain attack techniques.

Ose and Steindler (GitHub)

scriptc: Vercel's New TypeScript-to-Native Compiler — A new entry into the growing field of JS/TS native ahead-of-time compilers that makes the promise that "what compiles behaves byte-for-byte like Node." Static by default, but you can opt in to a --dynamic mode which embeds a JavaScript engine for runtime dynamism. GitHub repo.

Vercel Labs

Fast Endpoints Shouldn't Choke on Analytics — TimescaleDB extends Postgres so heavy queries stay fast at scale. One database, not two. Get $1000 credit to start.

Tiger Data (creators of TimescaleDB) sponsor

tslog 5: Zero-Dependency Logger for Node, Deno, Bun and Browsers — A ground-up rewrite that's now ESM-only. Pretty output by default, JSON optionally, plus middleware, file/HTTP/worker transports, secret masking, and error stacks that resolve through source maps to your .ts code. GitHub repo.

Eugene Terehov

npm-check-updates 23.0: Find Newer Versions of Dependencies — Find newer versions than your package.json allows. Has a -i interactive mode to look at upgrades and opt in to them one by one. Supports custom cooldown periods. v23 is faster, smaller, and is now a pure ESM package.

Raine Revere

jsdom 30.0: Pure JS Implementation of Web Standards for Node — The venerable browser-environment emulator used by countless test suites. v30.0 adds CSS.escape(), CSS.supports(), background-position-x/y, as well as some fixes.

Denicola, Insua, et al.

crypto-random-string 6.0: Generate a Cryptographically Strong Random String — For example: cryptoRandomString({length: 10}) might return 2cf05d94db. v6.0 improves performance and removes cryptoRandomStringAsync.

Sindre Sorhus