Project
Bun is a fast all-in-one JavaScript/TypeScript runtime, bundler, test runner, and package manager built as an alternative to Node.js.
pnpm, npm, Bun and Yarn can each refuse versions younger than a set age, using minutes, days, seconds and minutes respectively. Pasting pnpm's 1440 into npm makes the cooldown 1440 days, roughly 3.9 years.
Reality
Tensorlake's npm SDK 0.5.144 runs a credential-stealing worm from a preinstall hook at install time, Socket reported. According to Socket's analysis, any secret reachable from a workstation or build runner that installed the release may be exposed.
Perspective Coverage
4 publishersReality
Theo Browne's AI-written Rust port of the TypeScript compiler type-checks VS Code 13x faster than tsc 6 and cost over $420,000 in tokens. Browne says he never read the code, so the 181,711 ported tests it passes are the main evidence that it behaves correctly.
Reality
Unit 42 says supply-chain attackers have moved command-and-control into blockchain smart contracts, so one transaction can re-point an entire botnet or worm. Defenders' useful choke points are now developer machines, CI runners and the chain lookup itself.
Reality
Vercel Labs' experimental ScriptC compiles TypeScript to native binaries that started in 1.78ms against Node's 61.78ms in one benchmark. The gain holds for short, statically typed programs, while framework code and sustained compute both ran slower than Bun or Node.
Reality
Socket says workflows using issues-helper@v2.2.1 re-ran Mini Shai-Hulud after the Action was re-enabled on September 16 with its malicious tags intact. The earlier takedown only made those jobs fail, so the fix that holds is dropping the Action or pinning a verified commit SHA.
Reality
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Reality
Exact-substring scoring put a developer's 700-line RAG tool at a 65% retrieval hit-rate at k=3, 13 points below what a token-overlap scorer found. The bug also made extra retrieved chunks look worthless, and a 20-question test set added 15 points of noise.
Reality
Six engineers shipped a fully native Shop app in 12 weeks, but the first attempt at handing the React Native code to a model produced what Shopify's engineering director called slop. Helix chunks each screen instead.
Perspective Coverage
5 publishersReality
Stephen Toub of Microsoft writes that AI agents wrote most of the code and a single developer drove the port in a few months while the rest of the team kept expanding the runtime. The post puts the speedup at orders of magnitude.
Reality
TC39's iterator helpers are Baseline as of September 2026, so lazy chains run without a polyfill from Chrome 122 and Node 22 upward, while the teams reporting the 40-60% memory saving attached to them are unnamed.
Reality
Of the ten code migrations Anthropic says finished in a month, only one carries a dollar figure: 5.9 billion input tokens and 690 million output tokens, a million lines of Rust, about 16.5 cents a line.
Reality
Jarred Sumner's four-month rewrite checked transpiled Rust against a TypeScript suite that does not depend on the implementation language, and reaching a fully passing run cost about $165,000 in tokens.
Reality
Bun's port from Zig to Rust landed in four months because its test suite was written in TypeScript, independent of the language underneath, and because separate agents wrote the code and reviewed it.
Reality
One MIT-licensed proxy on localhost is enough to serve OpenAI's own desktop client from self-hosted models. The models that fail there fail on Codex's tool-call format. One of three tested got lost.
Reality
myc is an MIT-licensed memory layer for coding agents that installs into Claude Code's PreCompact event, writes the raw session to disk before it prints anything back, and hides the decisions it extracts until a human confirms them.
Reality
Size was the only reason to pick Tauri over Electron for this app, and the discount is real. What you take on in exchange is a second process whose lifetime and paths you now manage from Rust.
Reality
Four core SAP build packages shipped an identical 11.6MB credential stealer. Because npm trusted the whole cap-js repository rather than one branch, a commit pushed to an unused branch was enough to publish them.
Reality
Safari's loader took its host hooks from a proposal last updated in January 2016, which is why the top-level await bugs survived years of patching, and why the rewrite only helps traffic already on Safari 27.
Reality
Safari's "accessed before initialization" errors came from host hooks specified in a proposal last touched in 2016, before async/await existed in the language. WebKit rebuilt the loader rather than patch it again.
Reality