8 articles tagged
A hijacked maintainer account pushed Shai-Hulud malware into the keyv and cacheable npm family on 4 August 2026, with valid GitHub Actions provenance. Here is the containment order for the first 90 minutes.
Node.js still runs most of the world's backends, but Deno 2.9 and Bun 1.3.14 have removed the compatibility excuse. A senior engineer's decision framework, with 2026 benchmarks, npm compatibility, security defaults
The Node.js permission model gained --allow-net in v25 (October 2025). This guide shows how to scope file, network and process access in production, using the 2026 npm supply-chain attacks as motivation.
On July 27, 2026, Node.js patched HIGH-severity flaws across the 26.x, 24.x and 22.x lines, days after Next.js shipped its own. Here is which version to run and how to patch fast without breaking production.
Node.js is ending its twice-a-year major cycle. From October 2026 it ships one LTS release a year, and Node 27 lands in April 2027. What backend teams should change about upgrade planning and EOL risk.
npm 12 is generally available and tagged latest. Lifecycle scripts, git dependencies and remote tarballs are now opt-in, node-gyp builds are blocked, and the failure shows up in CI first. Here is the migration.
Bun 1.3 installs packages 25 times faster than npm and boots in milliseconds, but Node.js wins on ecosystem depth and support. A practical 2026 comparison, with real benchmarks and a clear verdict on when to use each.
Node.js now strips TypeScript types and runs the JavaScript underneath, so ts-node and a build step are optional. What works, what breaks, and why you still need tsc for type checking in 2026.
