Episode Details

News of the week of September 15, 2025: Shai-Hulud worm hits npm supply chain, WebAssembly 3 spec is ratified, and Elixir fans finally get their time in the spotlight. From the community: SquiggleConf was awesome, type branding and tuples, local-first app dev, and why @ts-ignore is almost always the worst option.

Chapters

• (00:00) - Welcome to the Show
• (04:36) - News: Shai-Hulud Worm Attacks Over 500 npm Packages
• (12:31) - News: WebAssembly 3 Spec is Done
• (14:05) - News: Ash Framework Announces AshTypeScript
• (15:08) - News: ts-to-zod Now Supports Zod 4
• (15:36) - News: Typebox 1.0 Release
• (17:26) - Community Highlight: SquiggleConf 2025 Happened!
• (20:51) - Community Highlight: Type Branding in TypeScript by AzraelSec
• (21:35) - Community Highlight: TypeScript Tuple Length Hacks
• (22:24) - Community Highlight: TypeScript Developer Roadmap
• (23:15) - Community Highlight: GitHub Actions Can Now Run Pure TypeScript
• (23:59) - Community Highlight: Why @ts-ignore is Almost Always the Worst Option
• (24:55) - Community Highlight: Using Node's Test Runner with TS and React
• (26:05) - Library Watch: Combinatorial CLI Options Parsing
• (27:53) - Library Watch: Valibot Helper Utilities
• (29:03) - Tool Watch: Local-first Development with FullStacked
• (31:15) - Tool Watch: Retro 3D Engine with TS Scripting API
• (32:09) - Discuss: Moving Off of TypeScript by Motion
• (41:34) - Funny Read: Is Your Son a Computer Hacker?
• (43:03) - Cool Library: Render a DOM Element as an Image
• (45:04) - Cool Tool: Pages CMS Runs on Top of Your Git Repo
• (47:08) - The Minnesota Long Goodbye

News

• Socket.dev covers Shai-Hulud: 
  • Updated and Ongoing Supply Chain Attack Targets CrowdStrike npm Packages 
  • Popular Tinycolor npm Package Compromised in Supply Chain Attack 
  • What the npm package attacks mean for us developers
• Wasm 3.0 spec completed
• Announcing AshTypeScript, part of the Ash Framework (Phoenix/Elixir)
• ts-to-zod now supports Zod 4.0
• Typebox 1.0 release

From the Community

• SquiggleConf Happened! Check out the streams (separate videos to come)
  • Day 1: https://www.youtube.com/live/C_ePbVZqXrw?si=MpRiE8n4xLNpfbV0
  • Day 2: https://www.youtube.com/live/vSXLDvvIpYE?si=cWKQTjZCx91HWJN9
• Federico (AzraelSec): Type Branding in Typescript 
• Renato: TypeScript Tuple Length 
• Evan Hahn: @ts-ignore is almost always the worst option
• Roadmap.sh: Everything You Need to Learn to be a TS Dev
• GitHub Actions can now run pure TS on Node 22/24 runners without a build step (h/t Brian Muenzenmeyer)
• Mathew Brown:

  Listen Now