--- title: "Vite 8 ships Rolldown, npm supply chain attack hits @antv ecosystem" url: https://daily.dev/posts/vite-8-ships-rolldown-npm-supply-chain-attack-hits-antv-ecosystem-aratufshk source_url: https://daily.dev/posts/vite-8-ships-rolldown-npm-supply-chain-attack-hits-antv-ecosystem-aratufshk type: freeform source: "Web Digest" published: 2026-05-20T04:17:52.966Z updated: 2026-05-20T04:18:22.494Z tags: ["security", "webdev", "npm", "vite"] reading_time: 5 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Vite 8 ships Rolldown, npm supply chain attack hits @antv ecosystem **[Web Digest](https://daily.dev/sources/webdev_digest)** · 5 min read · 1 upvotes · 0 comments ## Summary Vite 8 has launched, replacing the esbuild/Rollup dual-bundler setup with Rolldown, a Rust-based bundler that delivers build time reductions of up to 8x in real projects. A serious npm supply chain attack compromised 637 malicious versions across 317+ @antv packages, harvesting cloud and developer credentials and writing backdoors into Claude Code and VS Code configs — affected users must rotate all credentials and audit config files immediately. Google I/O 2026 introduced the 'Agentic Web' concept with WebMCP (a proposed standard for exposing site functions to browser agents), Chrome DevTools agent integration, and a stable on-device Prompt API with Gemini Nano. Storybook 10.4 adds TanStack React support, AI-assisted setup, and direct Chromatic publishing. Additional notable items include a new CSS border-shape property, Chrome HTML-in-Canvas experiments, Oxlint Vue/Svelte support, XSS passkey hijacking risks, and Gemini 3.5 Flash availability on Vercel AI Gateway. ## Content **TLDR:** Vite 8 dropped today with Rolldown replacing the esbuild/Rollup split, delivering real-world build time cuts of up to 8x. A coordinated npm supply chain attack compromised hundreds of @antv packages yesterday, and if you have those in your dependency tree you need to rotate credentials now. Google I/O 2026 pushed hard on the "Agentic Web" framing, with WebMCP and Chrome DevTools agent integration as the headline features. Storybook 10.4 also landed with TanStack React support and AI-assisted setup. --- ## Vite 8 replaces esbuild and Rollup with Rolldown Vite 8 swaps the dual-bundler setup for Rolldown, a single Rust-based bundler. Build times in real projects dropped anywhere from 57% to 8x — one benchmark went from 46 seconds to 6. Plugin API compatibility is maintained, and there's a built-in migration layer for existing esbuild and Rollup options. The new plugin-react v6 also swaps Babel for Oxc. There's a known issue with Yarn PnP on Windows, but otherwise this is a straightforward upgrade for most projects. ## Mini Shai-Hulud worm hits @antv npm packages On May 19, a compromised maintainer account published 637 malicious versions across 317-323 packages in roughly 22 minutes. High-download packages hit include size-sensor (4.2M downloads/month) and echarts-for-react (3.8M). The payload harvests AWS, GCP, Azure, GitHub, npm, Kubernetes, SSH, and Docker credentials, then exfiltrates them via encrypted channels. It also writes backdoors into Claude Code and VS Code configs, meaning removing the bad package version is not enough — you need to check those config files too. If you installed any affected @antv packages after May 18, rotate everything and audit your CI/CD environment. Pin to pre-May-18 versions. ## Google I/O 2026 bets on the Agentic Web The big theme from I/O was making the web legible to AI agents. WebMCP is a proposed open standard, currently in trial in Chrome 149, that lets sites expose JavaScript functions and HTML forms directly to browser-based agents. Shopify, Booking.com, and Expedia are already on board. Chrome DevTools 1.0 agent integration gives coding agents direct access to console logs, network traffic, and accessibility trees. Chrome 148 also ships the stable Prompt API with Gemini Nano for on-device summarization, and declarative partial updates land with out-of-order HTML streaming that doesn't require JavaScript. ## Storybook 10.4 Storybook 10.4 adds first-class TanStack React support via @storybook/tanstack-react with zero-config routing and server functions. AI agents can now auto-configure Storybook by analyzing project structure and writing stories. A new sidebar filter highlights stories affected by recent code changes, and a quick-share button publishes directly to Chromatic without needing a PR or CI run. There's also an experimental react-component-meta docgen analyzer powered by Volar and the TypeScript Language Server. --- ## Also notable - **CSS `border-shape` property:** Upcoming CSS property lets you define custom border shapes without losing box-shadow styling — a real limitation of the current `clip-path` workaround. Uses the `shape()` function for things like speech bubbles. - **Chrome HTML-in-Canvas:** Experimental flag in Chrome lets real DOM elements render inside canvas with `layoutsubtree` and `drawElementImage`, enabling CSS flexbox/grid inside canvas and GPU shader effects on actual HTML. Useful now for video rendering tools. - **Oxlint Vue and Svelte support:** An RFC is in progress to add Oxlint language plugins for Vue, Svelte, Angular, and Astro template linting beyond just script sections. - **React render boundaries:** A well-argued piece making the case that React performance problems are almost always about state lifted too high, not missing `useMemo` calls — worth reading before reaching for the React Compiler. - **XSS and passkeys:** A single XSS vulnerability can silently register an attacker-controlled passkey on a victim account when services use `attestation: "none"`, which most do to support synced passkeys from 1Password and iCloud Keychain. Defenses include step-up auth before passkey registration and a strong CSP. - **Gemini 3.5 Flash on Vercel AI Gateway:** Now available via `google/gemini-3.5-flash` in the AI SDK with improved coding and multi-turn coherence. Note: temperature, topP, topK, and thinking_budget are not supported. - **Vercel Flat Rate CDN:** Limited beta for Pro teams replaces usage-based CDN pricing with a fixed monthly fee covering Edge Requests and Fast Data Transfer. - **Firefox 151:** Built-in VPN now supports location selection across five countries; AI feature controls expand to iOS and Android; Shake to Summarize rolls out to Android in English. - **Appwrite Sites adds Bun and Deno runtimes:** Bun 1.0-1.3 and Deno 1.40-2.6 are now selectable build runtimes alongside Node, with no changes to project files required. - **Shopify Next Generation Events:** Developer preview of field-level webhook triggers that only fire when specific fields change, with custom payload definitions via Admin GraphQL — eliminates the need to diff state after a webhook lands. - **`useOptimistic` production patterns:** A solid writeup on React 19's `useOptimistic` hook covering list appending, boolean toggles, and inline editing with partial field merges, plus when not to use it (destructive actions, financial data). - **`:user-invalid` and `:user-valid`:** Drop `:invalid` and `:valid` on form inputs — they fire on page load before any interaction. The newer `:user-invalid` and `:user-valid` pseudo-classes only activate after the user has touched the field. --- Tags: [#security](https://daily.dev/tags/security), [#webdev](https://daily.dev/tags/webdev), [#npm](https://daily.dev/tags/npm), [#vite](https://daily.dev/tags/vite) [View this post on daily.dev](https://daily.dev/posts/vite-8-ships-rolldown-npm-supply-chain-attack-hits-antv-ecosystem-aratufshk)