Issue 785 of JavaScript Weekly covers a supply chain attack on TanStack npm packages via CI OIDC token theft and cache poisoning (not stolen credentials), affecting ~170 packages for 26 minutes. Mitigation tips include setting install-time cooldowns and auditing GitHub Actions with zizmor. Also featured: Rolldown 1.0 stable release (Rust-based bundler, 10–30x faster than Rollup, backbone for Vite 8), BlueJS ahead-of-time JS compiler producing tiny binaries, and releases including pnpm 11.1, Astro 6.3, Syncpack 15.0, and Expo SDK 56 Beta.
Sort: