Dev Stack
Zod 4.6.6 malware alarm: the bad commit never reached npm
Zod 4.6.6 shipped October 11 with malicious September 21 commits in its history. They were reverted that day, and none of them reached npm.
JavaScript news and analysis
JavaScript runtime and framework releases: Node.js security fixes, React's new stable features, Bun's Rust rewrite reaching production, and Shopify's move away from React Native. Each story gives the version number and what changed for a developer upgrading.
Dev Stack
Bun 1.4.3 adds bun check, a faster TypeScript type checker
Bun 1.4.3 adds bun check, a built-in TypeScript type checker that Bun says runs 3x to 6.4x faster than tsc 7.0.2 and passes all 51,210 conformance tests.
Dev Stack
Deno joins Cloudflare; Deno Deploy shuts in six months
The Deno team is joining Cloudflare. Deno Deploy shuts down in six months, the runtime gets a final year of monthly fixes, and JSR moves to Cloudflare.
Dev Stack
MALFEX npm malware ran undetected for 14 months
MALFEX, a one-person npm malware campaign, published 12 packages since 2023 and drew 40,767 downloads. Some packages are still live with no advisory.
Coding
Rejetto HFS CVE-2026-61500 exploited a day after write-up
HFS 3.0.0 to 3.2.0 signs logins with Math.random(), a flaw Anthropic's Mythos found. Attacks began October 3, a day after the write-up. 3.2.1 fixes it.
Dev Stack
npm trusted publishing can now move dist-tags over OIDC
npm trusted publishing can now add, move and remove dist-tags such as latest with short-lived OIDC tokens. It is off by default and needs npm 11.21.0.
Dev Stack
Node.js 22.23.3 LTS fixes an HTTP/2 use-after-free bug
Node.js 22.23.3 LTS, out September 23, fixes an HTTP/2 use-after-free bug, adds SharedArrayBuffer support to Node-API and moves to OpenSSL 3.5.8.
Coding
Shopify drops React Native for Swift and Kotlin
Shopify is rebuilding its apps in Swift and Kotlin 6 years after going all-in on React Native. Coding agents did enough of the porting to change the math.
Coding
React 19.3 ships View Transitions and Fragment Refs
React 19.3 shipped on September 9, 2026. View Transitions and Fragment Refs are now stable, and the release carries no breaking changes.
Dev Stack
Bun 1.4 ships the AI-driven Rust rewrite to production
Bun 1.4 is the first production release of the runtime's Zig-to-Rust rewrite, shipping faster startup and new APIs while critics question 13,044 unsafe blocks.
The weekly digest
One email every Friday with the week's top stories from all six desks: AI, dev tools, coding, the tech industry, startups and what's next. Free, no spam.