JS frameworks, React/Vue/Svelte, and runtime updates Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 20-2026bolt1 CRITICAL
article
Postmortem: TanStack npm Supply-Chain Compromise
TAG: SECURITY
On May 11, 2026, an attacker published 84 malicious versions across 42 @tanstack/* npm packages by chaining three techniques: the pull_request_target Pwn Request pattern, GitHub Actions cache poisoning across the fork-to-base trust boundary, and OIDC token extraction from the GitHub Actions runner process memory. Only the Router/Start family was affected; packages like Query, Table, Form, and Store remained clean. The malicious versions were detected within 26 minutes by external researcher Ashish Kurmi of StepSecurity, and all 84 versions were deprecated within about 103 minutes of the first publish. Anyone who ran npm install against an affected version on May 11 should treat the host as potentially compromised and rotate all reachable credentials including AWS, GitHub, npm, and SSH keys.
Bun v1.3.14 is a substantial feature release. The headline addition is Bun.Image, a built-in chainable image processing API supporting JPEG, PNG, WebP, GIF, and BMP across all platforms, with HEIC, AVIF, and TIFF on macOS and Windows, benchmarked 1.2-1.38x faster than sharp on common resize-and-convert workloads with 70x faster metadata reads. The release also adds experimental HTTP/3 (QUIC) server support via Bun.serve with http3: true reaching 509,135 req/s on static routes, experimental HTTP/2 and HTTP/3 client support in fetch() with connection multiplexing, a global virtual store for the isolated linker that cuts warm CI install times from 841 ms to 115 ms on a 1,400-package fixture, and a rewritten fs.watch() backend on POSIX platforms. Additional highlights include process.execve() matching Node.js v24, Bun.Terminal on Windows via ConPTY, native using/await using support without lowering, cross-language LTO across Zig and C++ boundaries, FreeBSD and Android first-party builds, and a fix for the TLS SSL_CTX memory leak affecting MongoDB and Mongoose connection pools.
Speeding Up the JavaScript Ecosystem: oxlint and oxfmt
TAG: TOOLING
Part 13 of Marvin Hagemeister's ongoing series diagnoses a performance bottleneck in oxlint and oxfmt that caused both tools to run at 6.1 seconds on codebases with 50,000 or more directories, despite the Rust parser being capable of processing hundreds of megabytes per second. Profiling revealed that config file discovery was triggering 150,000 sequential syscalls — three.is_file() stat calls per directory to check for .oxfmtrc.json, .oxfmtrc.jsonc, and oxlint.config.ts — each requiring a user-to-kernel context switch. The fix replaces the stat loop with readdir-based filename string comparisons and fuses the config discovery phase with the actual file traversal. The result: execution drops from 6.1 seconds to 2.8 seconds, more than a 50% improvement for large directory trees.
Mini Shai-Hulud Returns: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages
TAG: SECURITY
StepSecurity's deep technical analysis of the Mini Shai-Hulud worm reveals a sophisticated self-spreading attack that, for the first time in documented npm history, produced malicious packages carrying valid SLSA Build Level 3 provenance attestations via stolen GitHub OIDC tokens. The 2.3 MB obfuscated payload (router_init.js) uses three layers of obfuscation including an obfuscator.io string table, a PBKDF2-SHA256 derived secondary cipher, and AES-256-GCM encrypted sub-payloads. Once installed, it scrapes GitHub Actions runner process memory via /proc/pid/mem to steal every masked secret, harvests credentials from over 100 file paths, installs OS-level persistence via launchd or systemd, and injects malicious GitHub Actions workflows using toJSON(secrets). Exfiltration occurs through the Session Protocol CDN and GitHub GraphQL API dead-drop commits authored as claude@users.noreply.github.com with Dune-universe branch names.
ESLint v10.4.0 ships one notable feature: includeIgnoreFile() is now built into the eslint/config entrypoint rather than requiring the separate @eslint/compat package. The helper accepts an array of .gitignore-style file paths and a gitignoreResolution option that interprets patterns relative to each file's location, correctly handling nested .gitignore files across monorepos. The release also fixes a bug in the for-direction rule where sequence expressions were not checked, updates the @eslint/config-helpers dependency to ^0.6.0, and handles non-array deprecated rule replacements.
TanStack AI has achieved full bidirectional compliance with the AG-UI 0.0.52 protocol, making it the first SDK to implement both directions. Previously, @tanstack/ai-client already emitted AG-UI events server-to-client, but the client-to-server request body used a proprietary { messages, data } envelope. The new release switches the outbound envelope to the standard AG-UI RunAgentInput shape including threadId, runId, tools, context, and forwardedProps fields, enabling any AG-UI client such as CopilotKit or CrewAI to call a TanStack AI endpoint and vice versa. A chatParamsFromRequest() helper validates incoming requests against RunAgentInputSchema with automatic 400 error responses. Three backward-compatibility bridges ensure existing code continues working: body still mirrors forwardedProps, conversationId is an alias of threadId, and a jscodeshift codemod automates the migration.
Learn How to THINK in Code: The Hard and Conceptual Parts of JavaScript (Full Course)
This full-length freeCodeCamp course by Sumit Saha targets developers who want to move beyond memorizing JavaScript syntax and build engineering-grade mental models of how the engine actually works. The curriculum covers scope and closures, execution context and hoisting, the prototype chain and object-oriented patterns, event delegation and propagation, asynchronous patterns including the event loop and microtask queue, memoization, and multi-threading in both the browser and Node.js. The course is positioned for junior developers experiencing confusing bugs and for senior engineers who want a solid conceptual foundation for high-scale architecture decisions. Concrete runtime mechanics are illustrated with browser console demonstrations throughout.
On May 11, 2026, an attacker published 84 malicious versions across 42 @tanstack/* npm packages by chaining three techniques: the pull_request_target Pwn Request pattern, GitHub Actions cache poisoning across the fork-to-base trust boundary, and OIDC token extraction from the GitHub Actions runner process memory. Only the Router/Start family was affected; packages like Query, Table, Form, and Store remained clean. The malicious versions were detected within 26 minutes by external researcher Ashish Kurmi of StepSecurity, and all 84 versions were deprecated within about 103 minutes of the first publish. Anyone who ran npm install against an affected version on May 11 should treat the host as potentially compromised and rotate all reachable credentials including AWS, GitHub, npm, and SSH keys.
Learn How to THINK in Code: The Hard and Conceptual Parts of JavaScript (Full Course)
This full-length freeCodeCamp course by Sumit Saha targets developers who want to move beyond memorizing JavaScript syntax and build engineering-grade mental models of how the engine actually works. The curriculum covers scope and closures, execution context and hoisting, the prototype chain and object-oriented patterns, event delegation and propagation, asynchronous patterns including the event loop and microtask queue, memoization, and multi-threading in both the browser and Node.js. The course is positioned for junior developers experiencing confusing bugs and for senior engineers who want a solid conceptual foundation for high-scale architecture decisions. Concrete runtime mechanics are illustrated with browser console demonstrations throughout.
Bun v1.3.14 is a substantial feature release. The headline addition is Bun.Image, a built-in chainable image processing API supporting JPEG, PNG, WebP, GIF, and BMP across all platforms, with HEIC, AVIF, and TIFF on macOS and Windows, benchmarked 1.2-1.38x faster than sharp on common resize-and-convert workloads with 70x faster metadata reads. The release also adds experimental HTTP/3 (QUIC) server support via Bun.serve with http3: true reaching 509,135 req/s on static routes, experimental HTTP/2 and HTTP/3 client support in fetch() with connection multiplexing, a global virtual store for the isolated linker that cuts warm CI install times from 841 ms to 115 ms on a 1,400-package fixture, and a rewritten fs.watch() backend on POSIX platforms. Additional highlights include process.execve() matching Node.js v24, Bun.Terminal on Windows via ConPTY, native using/await using support without lowering, cross-language LTO across Zig and C++ boundaries, FreeBSD and Android first-party builds, and a fix for the TLS SSL_CTX memory leak affecting MongoDB and Mongoose connection pools.
Speeding Up the JavaScript Ecosystem: oxlint and oxfmt
Part 13 of Marvin Hagemeister's ongoing series diagnoses a performance bottleneck in oxlint and oxfmt that caused both tools to run at 6.1 seconds on codebases with 50,000 or more directories, despite the Rust parser being capable of processing hundreds of megabytes per second. Profiling revealed that config file discovery was triggering 150,000 sequential syscalls — three.is_file() stat calls per directory to check for .oxfmtrc.json, .oxfmtrc.jsonc, and oxlint.config.ts — each requiring a user-to-kernel context switch. The fix replaces the stat loop with readdir-based filename string comparisons and fuses the config discovery phase with the actual file traversal. The result: execution drops from 6.1 seconds to 2.8 seconds, more than a 50% improvement for large directory trees.
Mini Shai-Hulud Returns: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages
StepSecurity's deep technical analysis of the Mini Shai-Hulud worm reveals a sophisticated self-spreading attack that, for the first time in documented npm history, produced malicious packages carrying valid SLSA Build Level 3 provenance attestations via stolen GitHub OIDC tokens. The 2.3 MB obfuscated payload (router_init.js) uses three layers of obfuscation including an obfuscator.io string table, a PBKDF2-SHA256 derived secondary cipher, and AES-256-GCM encrypted sub-payloads. Once installed, it scrapes GitHub Actions runner process memory via /proc/pid/mem to steal every masked secret, harvests credentials from over 100 file paths, installs OS-level persistence via launchd or systemd, and injects malicious GitHub Actions workflows using toJSON(secrets). Exfiltration occurs through the Session Protocol CDN and GitHub GraphQL API dead-drop commits authored as claude@users.noreply.github.com with Dune-universe branch names.
ESLint v10.4.0 ships one notable feature: includeIgnoreFile() is now built into the eslint/config entrypoint rather than requiring the separate @eslint/compat package. The helper accepts an array of .gitignore-style file paths and a gitignoreResolution option that interprets patterns relative to each file's location, correctly handling nested .gitignore files across monorepos. The release also fixes a bug in the for-direction rule where sequence expressions were not checked, updates the @eslint/config-helpers dependency to ^0.6.0, and handles non-array deprecated rule replacements.
TanStack AI has achieved full bidirectional compliance with the AG-UI 0.0.52 protocol, making it the first SDK to implement both directions. Previously, @tanstack/ai-client already emitted AG-UI events server-to-client, but the client-to-server request body used a proprietary { messages, data } envelope. The new release switches the outbound envelope to the standard AG-UI RunAgentInput shape including threadId, runId, tools, context, and forwardedProps fields, enabling any AG-UI client such as CopilotKit or CrewAI to call a TanStack AI endpoint and vice versa. A chatParamsFromRequest() helper validates incoming requests against RunAgentInputSchema with automatic 400 error responses. Three backward-compatibility bridges ensure existing code continues working: body still mirrors forwardedProps, conversationId is an alias of threadId, and a jscodeshift codemod automates the migration.
The defining event of week 20 was a critical supply-chain attack dubbed Mini Shai-Hulud that struck 42 @tanstack/* npm packages on May 11, publishing 84 malicious versions within minutes by chaining a pull_request_target Pwn Request, GitHub Actions cache poisoning across fork trust boundaries, and OIDC token extraction from runner process memory. The Router/Start family was affected; packages like Query, Table, Form, and Store remained clean. StepSecurity researcher Ashish Kurmi detected the compromise within 26 minutes, and all 84 versions were deprecated within 103 minutes. Anyone who ran npm install against an affected version must treat the host as compromised and rotate all reachable credentials including AWS, GitHub, npm, and SSH keys.
On the runtime front, Bun v1.3.14 delivered a substantial feature release headlined by Bun.Image — a built-in chainable image processing API benchmarked 1.2–1.38x faster than sharp for common resize-and-convert workloads and 70x faster on metadata reads. The release also ships experimental HTTP/3 (QUIC) server support reaching 509,135 req/s on static routes, an isolated linker global virtual store cutting warm CI install times from 841 ms to 115 ms, and a fix for the TLS SSL_CTX memory leak affecting MongoDB and Mongoose connection pools.
Beyond security and runtime news, TanStack AI achieved full bidirectional AG-UI 0.0.52 protocol compliance, becoming the first SDK to implement both directions. ESLint v10.4.0 promoted includeIgnoreFile() from the separate @eslint/compat package into the core eslint/config entrypoint. And Marvin Hagemeister's performance series diagnosed a 150,000-syscall config discovery bottleneck in oxlint and oxfmt, reducing execution from 6.1 seconds to 2.8 seconds by replacing stat loops with readdir-based filename comparisons.
Key Takeaways
If you ran npm install on May 11, 2026 against any @tanstack/router or @tanstack/start version, treat your CI runner and developer machine as compromised and immediately rotate AWS, GitHub, npm, and SSH credentials.
Bun v1.3.14 makes Bun a credible sharp replacement for image pipelines: Bun.Image is 1.2–1.38x faster on resize-convert and 70x faster on metadata reads, with HTTP/3 server support now experimental at 509K req/s.
ESLint v10.4.0 ships includeIgnoreFile() into core — no more @eslint/compat dependency — and oxlint/oxfmt cut large-repo run time by over 50% by swapping stat syscall loops for readdir string comparisons.
