<p><strong>TLDR:</strong> Three malicious versions of node-ipc were published to npm on May 14, stealing cloud credentials, SSH keys, and CI/CD secrets via DNS exfiltration. If you’re running any of the affected versions, rotate everything now. On the framework side, SolidJS 2.0 beta landed with async as a first-class primitive and a reworked Suspense model. CSS gap decorations also shipped stable in Chrome and Edge 149, finally killing the pseudo-element workaround.</p>
<hr>
<h2>node-ipc npm compromise</h2>
<p>Versions 9.1.6, 9.2.3, and 12.0.1 of node-ipc were published with an obfuscated credential-stealing payload injected into the CommonJS entrypoint. The malware runs on <code>require()</code>, not at install time, and targets over 90 credential categories: AWS/Azure/GCP keys, SSH keys, Kubernetes tokens, GitHub CLI config, <code>.env</code> files, and CI/CD secrets. Stolen data is compressed and exfiltrated via DNS TXT queries to a fake Azure-themed domain, leaving no persistence behind. The attack likely came from account takeover via re-registration of an expired maintainer email domain. If you installed any of the affected versions, rotate all credentials immediately, clear your npm cache, and rebuild from a clean dependency tree.</p>
<h2>TanStack supply chain attack via GitHub Actions</h2>
<p>Separately, attackers published 84 malicious versions across 42 TanStack packages by poisoning GitHub Actions cache and extracting OIDC tokens to publish through legitimate CI/CD pipelines. This is a different attack vector from the node-ipc compromise but the same general category of problem. The JavaScript ecosystem’s deep dependency trees and loose publish controls keep making this easy. pnpm v11’s new default <code>minimumReleaseAge</code> of one day is a reasonable baseline defense — Yarn, Bun, and npm all have equivalent settings now. A 3-7 day cooldown won’t stop everything, but it gives the community time to catch malicious publishes before they land in your lockfile.</p>
<h2>SolidJS 2.0 beta</h2>
<p>SolidJS 2.0 skipped the planned alpha and went straight to beta. The headline change is that computations can now return Promises directly, and the reactive graph handles suspension and resumption automatically — including <code>createMemo</code> with async values. The Suspense model is reworked: <code>Loading</code> handles initial readiness, <code>isPending()</code> handles subsequent pending state. Updates are now microtask-batched with deterministic scheduling via <code>flush()</code>. Breaking changes include removal of the <code>Index</code> component (replaced by <code>For keyed={false}</code>), <code>createEffect</code> split into compute/apply phases, and <code>onMount</code> replaced by <code>onSettled</code>. Install via npm under the <code>next</code> tag; a migration guide is available.</p>
<h2>CSS gap decorations ship in Chrome and Edge 149</h2>
<p>Gap decorations are now stable, letting you style the gaps between grid, flex, and multi-column items without borders, pseudo-elements, or extra DOM nodes. The feature extends <code>column-rule</code> to grid and flexbox, adds a new <code>row-rule</code> property, and includes <code>repeat()</code> syntax for cycling styles, <code>rule-break</code> for intersection behavior, and <code>rule-inset</code> for shrinking or extending decorations. It’s a progressive enhancement — browsers that don’t support it just show nothing. This one has been a long time coming.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>CVE-2025-55182 (React Server Components RCE):</strong> CVSS 10 pre-auth remote code execution in Next.js App Router / React Server Components — upgrade to patched versions immediately and rotate secrets if your app was exposed.</li>
<li><strong>Microsoft Edge password fix:</strong> Edge was decrypting all saved passwords into process memory at startup and keeping them there. Microsoft initially called it “by design,” then reversed course after public pressure. Fix is live in Canary, rolling out to Edge 148+.</li>
<li><strong>Vercel Protected Source Maps:</strong> <code>.map</code> files are now gated behind Vercel Authentication — public requests get a 404, team members with deployment access can still fetch them. Enabled by default on new projects.</li>
<li><strong>Vercel <code>curl</code> command:</strong> <code>vercel curl &lt;url&gt;</code> authenticates requests within the Vercel ecosystem using your auth token, solving the 401 problem agents hit when trying to access their own SSO-protected deployments.</li>
<li><strong>v0 Browser Use:</strong> v0 can now open the apps it builds, interact with them, and proactively fix issues, sending screenshots back to the user during the process.</li>
<li><strong>zero-native (Zig desktop shell):</strong> Vercel Labs released a Zig-based desktop shell that gives web apps direct OS SDK access without bundling Chromium — binaries under 1MB, supports React, Svelte, Vue, Next.js, and Vite.</li>
<li><strong>Google Antigravity April update:</strong> The VS Code fork for agentic AI development added tiered permissions (Allow/Ask/Deny) across terminal, filesystem, network, and MCP tools — enough for at least one developer to switch from VS Code full-time.</li>
<li><strong>State of JavaScript 2024 libraries:</strong> React positive sentiment dropped to 35% (from 68% in 2016), Next.js sentiment fell sharply, Vite leads build tools at 72% positive, and pnpm is now the most positively regarded package manager.</li>
<li><strong>ESLint v10.4.0:</strong> <code>includeIgnoreFile()</code> is now built into <code>eslint/config</code> directly, with support for multiple <code>.gitignore</code> files and a <code>gitignoreResolution</code> option useful for monorepos.</li>
<li><strong>pnpm v11 deep dive:</strong> Lead maintainer Zoltan Kochan confirmed a Rust rewrite is in progress, enabled by AI-assisted development, with a Rust-based frozen install engine planned for v12.</li>
<li><strong>Julia Evans on leaving Tailwind:</strong> A detailed writeup on migrating to vanilla CSS with semantic HTML, covering CSS resets, component scoping, lobotomized owl selectors for spacing, and CSS Grid with <code>auto-fit</code> instead of media queries.</li>
<li><strong>GitHub accessibility agent:</strong> After reviewing 3,535 PRs with a 68% resolution rate, GitHub’s Copilot-integrated accessibility agent team notes that ~36% of WCAG A/AA criteria can’t be automatically detected — the agent routes complex cases to human experts.</li>
<li><strong><code>minimumReleaseAge</code> across package managers:</strong> pnpm, Yarn, Bun, and npm all support a minimum release age setting now. A 3-7 day window is a reasonable baseline against newly published malicious versions.</li>
</ul>


Frontend development news, CSS techniques, framework updates, and browser API changes.

Web Digest

Three malicious node-ipc versions (9.1.6, 9.2.3, 12.0.1) were published to npm, stealing cloud credentials, SSH keys, and CI/CD secrets via DNS exfiltration — rotate all credentials if affected. A separate TanStack supply chain attack exploited GitHub Actions OIDC tokens to publish 84 malicious package versions. SolidJS 2.0 beta launched with async as a first-class reactive primitive, a reworked Suspense model, microtask-batched updates, and several breaking changes. CSS gap decorations shipped stable in Chrome/Edge 149, enabling native gap styling for grid and flex layouts. Also covered: a CVSS 10 Next.js RCE (CVE-2025-55182), Microsoft Edge password memory exposure fix, Vercel Protected Source Maps, pnpm v11 minimumReleaseAge defense, State of JavaScript 2024 sentiment data, and ESLint v10.4.0.

node-ipc supply chain attack hits npm, SolidJS 2.0 beta drops