JS frameworks, React/Vue/Svelte, and runtime updates Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 15-2026bolt1 CRITICAL
article
axios Compromised on npm: Malicious Versions Drop Remote Access Trojan
TAG: SUPPLY CHAIN
On March 30, 2026, StepSecurity identified two malicious axios versions — axios@1.14.1 and axios@0.30.4 — published to npm via a hijacked maintainer account whose email was changed to an attacker-controlled ProtonMail address. Both releases inject a phantom dependency, plain-crypto-js@4.2.1, which never appears in any axios source file but fires a postinstall hook that deploys a cross-platform RAT dropper targeting macOS, Windows, and Linux. The dropper contacts C2 at sfrclak.com:8000 within two seconds of npm install, delivers platform-specific second-stage payloads, then self-destructs and swaps its own package.json with a clean stub reporting version 4.2.0 to defeat forensic inspection. With over 100 million weekly downloads, this is the highest-impact single-package compromise in npm history. Immediate remediation: downgrade to axios@1.14.0 or axios@0.30.3 and run npm ci --ignore-scripts.
Bun v1.3.12 ships Bun.WebView, a built-in headless browser automation API backed by either WebKit (macOS, zero dependencies) or Chrome via DevTools Protocol, dispatching OS-level events that sites cannot distinguish from real user input. The release also adds bun ./file.md terminal Markdown rendering, Bun.cron() in-process scheduling with no-overlap and Disposable support, in-process package release-age gating (minimumReleaseAge in bunfig.toml), and an upgraded JavaScriptCore engine with 1,650+ upstream commits including native using/await using support, faster promise resolution, and WASM SIMD improvements. Additional highlights include TCP_DEFER_ACCEPT for Bun.serve() on Linux, HTTPS proxy CONNECT tunnel keep-alive, URLPattern up to 2.3x faster, and SIMD-accelerated Bun.stripANSI up to 11x faster for large UTF-16 inputs.
Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack
TAG: SUPPLY CHAIN
StepSecurity's AI Package Analyst flagged axios@1.14.1 as critical within minutes of publication, identifying six suspicious signals including an undocumented plain-crypto-js dependency and dropped OIDC provenance attestation. When co-founder Ashish Kurmi posted a warning GitHub issue, a threat actor using the compromised jasonsaayman account deleted it — a cat-and-mouse cycle that repeated roughly 20 times before GitHub suspended the account. The attacker, later attributed to North Korean group UNC1069 (Sapphire Sleet) by Google Threat Intelligence Group and Microsoft, had socially engineered the maintainer via a fake Slack workspace and Microsoft Teams call into downloading a RAT that stole a long-lived npm token. StepSecurity Harden-Runner independently confirmed C2 callbacks to sfrclak.com across 12,000+ monitored public repositories, and a community webinar drew 472 registrants and 200 live attendees within 24 hours of announcement.
Solid 2.0 Beta Support in TanStack Router, Start, and Query
TAG: FRAMEWORK
TanStack Router, TanStack Start, and TanStack Query now offer beta support for Solid 2.0, enabling developers to try the new framework in real applications rather than isolated demos. Upgrading requires installing @tanstack/solid-router@^2.0.0-beta.11, @tanstack/solid-start@^2.0.0-beta.12, solid-js@^2.0.0-beta.5, and vite-plugin-solid@^3.0.0-next.4, with optional @tanstack/solid-query@^6.0.0-beta.3 for data fetching. Solid 2.0 introduces major changes to async rendering, derived state, and SSR that are particularly impactful in larger applications where routing and server rendering carry real weight. The TanStack team plans to track Solid core closely from beta through RC to stable, keeping all three packages aligned throughout the 2.0 rollout.
ArkType: The Parse-Don't-Validate Sequel I Didn't Know I Needed
TAG: TYPESCRIPT
Christian Ekrem explores ArkType as a practical answer to hand-rolling branded parsers in TypeScript. ArkType's string DSL lets you write type({ email: "string.email", age: "0 <= number.integer <= 150" }) and get both compile-time types and runtime validators from one definition, benchmarking at 14 nanoseconds per object validation versus Zod's 281 ns. Morphs — transforms like "string.numeric.parse" — convert an input type to a different output type in one expression, bridging the compile-runtime gap. Automatic union discrimination avoids the explicit discriminant field required by Zod's discriminatedUnion. The honest tradeoffs: ArkType's bundle is ~42 KB minified (vs Zod's ~13 KB), ecosystem integrations number around five (Zod has 50+), and the instanceof-based error check adds friction when composing with Result-based FP libraries like neverthrow or Effect.
Webpack 5.106 introduces five notable changes. A new compiler.hooks.validate hook lets plugin authors register schema validation logic that respects the global validate: false flag. CSS Modules gain exportType: "style" support, enabling runtime style injection via HTMLStyleElement without style-loader. CommonJS destructuring (const { add } = require('./math')) is now statically analyzed so only referenced exports survive tree shaking. Stage 3 TC39 Source Phase Imports land as an experimental feature for WebAssembly modules (experiments.sourceImport). Finally, an experimental oxc-parser integration is available for development/benchmarking environments to evaluate faster JavaScript parsing. The webpack-cli ecosystem also sees a major v7 release requiring Node.js 20.9.0 with native TypeScript config support via dynamic import().
Kyle from Web Dev Simplified makes the case for useSyncExternalStore as the correct hook for synchronizing browser-external state into React, replacing the common useEffect-plus-useState pattern. The video walks through two concrete examples: tracking navigator.onLine status and syncing a dialog element's open state (including escape-key-triggered close that useEffect misses). It then demonstrates building a lightweight global store from scratch in todoStore.ts — with a subscribe function backed by a Set of listeners, a getSnapshot function returning the current array, and mutation functions that notify listeners — as an alternative to context or Zustand. The hook's optional third parameter enables server-side rendering by providing a server-safe default snapshot, a capability useEffect entirely lacks.
axios Compromised on npm: Malicious Versions Drop Remote Access Trojan
On March 30, 2026, StepSecurity identified two malicious axios versions — axios@1.14.1 and axios@0.30.4 — published to npm via a hijacked maintainer account whose email was changed to an attacker-controlled ProtonMail address. Both releases inject a phantom dependency, plain-crypto-js@4.2.1, which never appears in any axios source file but fires a postinstall hook that deploys a cross-platform RAT dropper targeting macOS, Windows, and Linux. The dropper contacts C2 at sfrclak.com:8000 within two seconds of npm install, delivers platform-specific second-stage payloads, then self-destructs and swaps its own package.json with a clean stub reporting version 4.2.0 to defeat forensic inspection. With over 100 million weekly downloads, this is the highest-impact single-package compromise in npm history. Immediate remediation: downgrade to axios@1.14.0 or axios@0.30.3 and run npm ci --ignore-scripts.
Kyle from Web Dev Simplified makes the case for useSyncExternalStore as the correct hook for synchronizing browser-external state into React, replacing the common useEffect-plus-useState pattern. The video walks through two concrete examples: tracking navigator.onLine status and syncing a dialog element's open state (including escape-key-triggered close that useEffect misses). It then demonstrates building a lightweight global store from scratch in todoStore.ts — with a subscribe function backed by a Set of listeners, a getSnapshot function returning the current array, and mutation functions that notify listeners — as an alternative to context or Zustand. The hook's optional third parameter enables server-side rendering by providing a server-safe default snapshot, a capability useEffect entirely lacks.
Bun v1.3.12 ships Bun.WebView, a built-in headless browser automation API backed by either WebKit (macOS, zero dependencies) or Chrome via DevTools Protocol, dispatching OS-level events that sites cannot distinguish from real user input. The release also adds bun ./file.md terminal Markdown rendering, Bun.cron() in-process scheduling with no-overlap and Disposable support, in-process package release-age gating (minimumReleaseAge in bunfig.toml), and an upgraded JavaScriptCore engine with 1,650+ upstream commits including native using/await using support, faster promise resolution, and WASM SIMD improvements. Additional highlights include TCP_DEFER_ACCEPT for Bun.serve() on Linux, HTTPS proxy CONNECT tunnel keep-alive, URLPattern up to 2.3x faster, and SIMD-accelerated Bun.stripANSI up to 11x faster for large UTF-16 inputs.
Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack
StepSecurity's AI Package Analyst flagged axios@1.14.1 as critical within minutes of publication, identifying six suspicious signals including an undocumented plain-crypto-js dependency and dropped OIDC provenance attestation. When co-founder Ashish Kurmi posted a warning GitHub issue, a threat actor using the compromised jasonsaayman account deleted it — a cat-and-mouse cycle that repeated roughly 20 times before GitHub suspended the account. The attacker, later attributed to North Korean group UNC1069 (Sapphire Sleet) by Google Threat Intelligence Group and Microsoft, had socially engineered the maintainer via a fake Slack workspace and Microsoft Teams call into downloading a RAT that stole a long-lived npm token. StepSecurity Harden-Runner independently confirmed C2 callbacks to sfrclak.com across 12,000+ monitored public repositories, and a community webinar drew 472 registrants and 200 live attendees within 24 hours of announcement.
Solid 2.0 Beta Support in TanStack Router, Start, and Query
TanStack Router, TanStack Start, and TanStack Query now offer beta support for Solid 2.0, enabling developers to try the new framework in real applications rather than isolated demos. Upgrading requires installing @tanstack/solid-router@^2.0.0-beta.11, @tanstack/solid-start@^2.0.0-beta.12, solid-js@^2.0.0-beta.5, and vite-plugin-solid@^3.0.0-next.4, with optional @tanstack/solid-query@^6.0.0-beta.3 for data fetching. Solid 2.0 introduces major changes to async rendering, derived state, and SSR that are particularly impactful in larger applications where routing and server rendering carry real weight. The TanStack team plans to track Solid core closely from beta through RC to stable, keeping all three packages aligned throughout the 2.0 rollout.
ArkType: The Parse-Don't-Validate Sequel I Didn't Know I Needed
Christian Ekrem explores ArkType as a practical answer to hand-rolling branded parsers in TypeScript. ArkType's string DSL lets you write type({ email: "string.email", age: "0 <= number.integer <= 150" }) and get both compile-time types and runtime validators from one definition, benchmarking at 14 nanoseconds per object validation versus Zod's 281 ns. Morphs — transforms like "string.numeric.parse" — convert an input type to a different output type in one expression, bridging the compile-runtime gap. Automatic union discrimination avoids the explicit discriminant field required by Zod's discriminatedUnion. The honest tradeoffs: ArkType's bundle is ~42 KB minified (vs Zod's ~13 KB), ecosystem integrations number around five (Zod has 50+), and the instanceof-based error check adds friction when composing with Result-based FP libraries like neverthrow or Effect.
Webpack 5.106 introduces five notable changes. A new compiler.hooks.validate hook lets plugin authors register schema validation logic that respects the global validate: false flag. CSS Modules gain exportType: "style" support, enabling runtime style injection via HTMLStyleElement without style-loader. CommonJS destructuring (const { add } = require('./math')) is now statically analyzed so only referenced exports survive tree shaking. Stage 3 TC39 Source Phase Imports land as an experimental feature for WebAssembly modules (experiments.sourceImport). Finally, an experimental oxc-parser integration is available for development/benchmarking environments to evaluate faster JavaScript parsing. The webpack-cli ecosystem also sees a major v7 release requiring Node.js 20.9.0 with native TypeScript config support via dynamic import().
The week's biggest story was the npm supply chain attack targeting axios, the most-downloaded HTTP client on the platform. Two malicious versions — axios@1.14.1 and axios@0.30.4 — were published via a hijacked maintainer account and bundled a phantom dependency, plain-crypto-js@4.2.1, that deployed a cross-platform remote access trojan within two seconds of install. The attack was attributed to North Korean group UNC1069 (Sapphire Sleet) and constitutes the highest-impact single-package compromise in npm history. Immediate remediation requires downgrading to axios@1.14.0 or axios@0.30.3 and running npm ci --ignore-scripts.
On the runtime and tooling front, Bun v1.3.12 shipped Bun.WebView for built-in headless browser automation, Bun.cron() for in-process scheduling, and a JavaScriptCore engine upgrade with over 1,650 upstream commits including native using/await using support. Webpack 5.106 added CommonJS destructuring tree-shaking, CSS Modules exportType: "style" support, and experimental TC39 Stage 3 Source Phase Imports for WebAssembly. webpack-cli also saw a major v7 release requiring Node.js 20.9.0 with native TypeScript config support.
In the framework space, TanStack Router, Start, and Query added beta support for Solid 2.0, requiring solid-js@^2.0.0-beta.5 and vite-plugin-solid@^3.0.0-next.4. ArkType emerged as a compelling Zod alternative benchmarking at 14 ns per object validation versus Zod's 281 ns, though its 42 KB bundle and limited ecosystem integrations remain tradeoffs. A deep dive on useSyncExternalStore demonstrated how it correctly handles browser-external state including navigator.onLine and dialog open state, with SSR support that useEffect entirely lacks.
Key Takeaways
Immediately downgrade to axios@1.14.0 or axios@0.30.3 — versions 1.14.1 and 0.30.4 contain a supply-chain RAT attributed to North Korean group UNC1069, and always run npm ci --ignore-scripts.
Bun v1.3.12 ships Bun.WebView for zero-dependency headless browser automation on macOS and adds Bun.cron() for in-process scheduling with no-overlap guarantees.
ArkType validates objects at 14 ns versus Zod's 281 ns using a single string DSL definition, but its 42 KB bundle and ~5 ecosystem integrations (versus Zod's 50+) mean Zod remains the safer default for most projects.
