Scott Cooper

I won’t go back. I won’t use generators like effectjs wants either. Next we’ll reinvent zone.js

I feel like the "learn how to use grid" websites were always way harder than actually using grid.

My Favorite NPM Command An ode to `npm repo`, the best npm command.

Astro is really fun because you can just vibe code a little animation in html and add it to your blog post. sigh.dev/posts/favori...

Would love to somehow say my package will never have a postinstall script

i want to know who made the "cheetah" model in cursor

I live in constant fear

Strengthening npm security: Important changes to authentication and token management - GitHub Changelog As part of our ongoing commitment to securing the npm ecosystem, we’re implementing the first phase of security improvements outlined in our recent announcement. These changes will roll out over…

Stop sending me this. github.blog/changelog/20...

fix: mark `FormData` & `URLSearchParams` as non-serializable for bun … · unjs/ofetch@4e4d3ee …compatibility (#483)

@pi0.io would love to see a new version of oftech get released. Need that bun fix. 🙈 github.com/unjs/ofetch/...

Deus Ex Remastered coming to Steam/Switch/Xbox/PS5 on Feb 5th, 2026 www.youtube.com/watch?v=z-Sg...

TanStack | High Quality Open-Source Software for Web Developers Headless, type-safe, powerful utilities for complex workflows like Data Management, Data Visualization, Charts, Tables, and UI Components.

🚀 Announcing TanStack.com Start v1 Release Candidate!

Upgrades ↓

✨ Unified Route Tree: no more server-specific files
🔐 Type-safe middleware & server context upgrades
🛡 CSP/nonce support
⚡ Now works with any native Vite Env plugin
🌀 Zero-JS: any server handler can render!

Our plan for a more secure npm supply chain GitHub is strengthening npm's security with stricter authentication, granular tokens, and enhanced trusted publishing.

I managed my tokens so poorly that npm changed their policy. Progress! github.blog/security/sup...

dm's are open i think

A lot of the related security blogs recommended switching to pnpm to avoid running unapproved postinstall scripts.

Mostly mention it because that is already what I am doing.

@ctrl/tinycolor Supply Chain Attack Post-mortem Lessons learned from becoming the unexpected face of a npm supply-chain attack.

I've published my perspective of the @ctrl/tinycolor NPM supply chain attack. This whole thing got me to finally make a blog.

sigh.dev/posts/ctrl-t...

they force pushed a branch directly because they were a repo admin. Not a pr.

no in this case it was a "shai-hulud" branch pushed to a shared repo where multiple people have admin access.

This shai-hulud branch contains a github action that runs on push.
This shared repo had my npm token as a secret for github action publishing.

bsky.app/profile/scoo...

bsky.app/profile/scoo... not 100% certain, but not seeing the bad branches on my own repos

i believe i figured it out. A project i collaborated on got a "bad" github branch by a collaborator. This project had an npm token of mine.

no not for certain yet, currently it seems like a publish token was public or leaked

Not seeing the weird githu branch names or repos from some of the newer hacks

I am publishing new versions of affected packages

taking a look

The other major reason was we switched to the biome formatter but found it didn't support css-in-js and still does not. So we then had pretter, eslint (for various rules biome was missing), and biome at one time.

Today's word is espoused

Announcing TypeScript 5.9 - TypeScript Today we are excited to announce the release of TypeScript 5.9! If you’re not familiar with TypeScript, it’s a language that builds on JavaScript by adding syntax for types. With types, TypeScript mak...

TypeScript 5.9 is now available! 📣

This release brings:

✅ An updated tsc --init
✅ Type-checking for the new 'import defer'
✅ Actual summaries in more DOM APIs
✅ Expandable quick info hovers (✨preview✨)

and more! Read up more on our blog:

devblogs.microsoft.com/typescript/a...

rspack doing damage to webpack's numbers

You will review my vibe code until exhaustion

We wrote a blog sharing some findings from our binary size optimization journey - exploring efficient ways to embed large string HashMaps statically in programs: github.com/orgs/web-inf...

The Best Movies of the 21st Century: How Actors, Directors and Other Film Lovers Voted To determine the best movies of the 21st century, we polled hundreds of celebrities. See how your favorite stars and directors voted.

really enjoying the film list stuff @nytimes.com is doing this week.

they should make a rotisserie chicken you can vape