Let the Spicy Takes Flow: Shai-Hulud Hits npm, Motion's TS Exodus | News | Ep 36

News of the week of September 15, 2025: Shai-Hulud worm hits npm supply chain, WebAssembly 3 spec is ratified, and Elixir fans finally get their time in the spotlight. From the community: SquiggleConf was awesome, type branding and tuples, local-first app dev, and why @ts-ignore is almost always the worst option.

Chapters

• (00:00) - Welcome to the Show
• (04:36) - News: Shai-Hulud Worm Attacks Over 500 npm Packages
• (12:31) - News: WebAssembly 3 Spec is Done
• (14:05) - News: Ash Framework Announces AshTypeScript
• (15:08) - News: ts-to-zod Now Supports Zod 4
• (15:36) - News: Typebox 1.0 Release
• (17:26) - Community Highlight: SquiggleConf 2025 Happened!
• (20:51) - Community Highlight: Type Branding in TypeScript by AzraelSec
• (21:35) - Community Highlight: TypeScript Tuple Length Hacks
• (22:24) - Community Highlight: TypeScript Developer Roadmap
• (23:15) - Community Highlight: GitHub Actions Can Now Run Pure TypeScript
• (23:59) - Community Highlight: Why @ts-ignore is Almost Always the Worst Option
• (24:55) - Community Highlight: Using Node's Test Runner with TS and React
• (26:05) - Library Watch: Combinatorial CLI Options Parsing
• (27:53) - Library Watch: Valibot Helper Utilities
• (29:03) - Tool Watch: Local-first Development with FullStacked
• (31:15) - Tool Watch: Retro 3D Engine with TS Scripting API
• (32:09) - Discuss: Moving Off of TypeScript by Motion
• (41:34) - Funny Read: Is Your Son a Computer Hacker?
• (43:03) - Cool Library: Render a DOM Element as an Image
• (45:04) - Cool Tool: Pages CMS Runs on Top of Your Git Repo
• (47:08) - The Minnesota Long Goodbye

News

• Socket.dev covers Shai-Hulud:
  • Updated and Ongoing Supply Chain Attack Targets CrowdStrike npm Packages
  • Popular Tinycolor npm Package Compromised in Supply Chain Attack
  • What the npm package attacks mean for us developers
• Wasm 3.0 spec completed
• Announcing AshTypeScript, part of the Ash Framework (Phoenix/Elixir)
• ts-to-zod now supports Zod 4.0
• Typebox 1.0 release

From the Community

• SquiggleConf Happened! Check out the streams (separate videos to come)
  • Day 1: https://www.youtube.com/live/C_ePbVZqXrw?si=MpRiE8n4xLNpfbV0
  • Day 2: https://www.youtube.com/live/vSXLDvvIpYE?si=cWKQTjZCx91HWJN9
• Federico (AzraelSec): Type Branding in Typescript
• Renato: TypeScript Tuple Length
• Evan Hahn: @ts-ignore is almost always the worst option
• Roadmap.sh: Everything You Need to Learn to be a TS Dev
• GitHub Actions can now run pure TS on Node 22/24 runners without a build step (h/t Brian Muenzenmeyer)
• Mathew Brown: Using Node's Test Runner with Typescript & React
• Library Watch: Combinatorial CLI opt parsing
• Library Watch: Introducing: @traversable/valibot (h/t Andrew Jarret)
• Tool watch: FullStacked, a local-first app development environment
• Tool watch: Roguestrad, a Retro 3D Game engine forked from DOOM-3-BFG with TypeScript scripting support

Cool Stuff

• Funny Read: Is your son a computer hacker?
• Cool Lib: dom-to-image-more – render DOM elements as images
• Cool Tool: Pages CMS - Hassle-free CMS for static sites powered by Git

Sponsored by Excalibur.js
Excalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.

Music
Seahorse Dreams by Kubbi (Spotify)