Let the Spicy Takes Flow: Shai-Hulud Hits npm, Motion's TS Exodus | News | Ep 36

News of the week of September 15, 2025: Shai-Hulud worm hits npm supply chain, WebAssembly 3 spec is ratified, and Elixir fans finally get their time in the spotlight. From the community: SquiggleConf was awesome, type branding and tuples, local-first app dev, and why @ts-ignore is almost always the worst option.Chapters(00:00) - Welcome to the Show (04:36) - News: Shai-Hulud Worm Attacks Over 500 npm Packages (12:31) - News: WebAssembly 3 Spec is Done (14:05) - News: Ash Framework Announces AshTypeScript (15:08) - News: ts-to-zod Now Supports Zod 4 (15:36) - News: Typebox 1.0 Release (17:26) - Community Highlight: SquiggleConf 2025 Happened! (20:51) - Community Highlight: Type Branding in TypeScript by AzraelSec (21:35) - Community Highlight: TypeScript Tuple Length Hacks (22:24) - Community Highlight: TypeScript Developer Roadmap (23:15) - Community Highlight: GitHub Actions Can Now Run Pure TypeScript (23:59) - Community Highlight: Why @ts-ignore is Almost Always the Worst Option (24:55) - Community Highlight: Using Node's Test Runner with TS and React (26:05) - Library Watch: Combinatorial CLI Options Parsing (27:53) - Library Watch: Valibot Helper Utilities (29:03) - Tool Watch: Local-first Development with FullStacked (31:15) - Tool Watch: Retro 3D Engine with TS Scripting API (32:09) - Discuss: Moving Off of TypeScript by Motion (41:34) - Funny Read: Is Your Son a Computer Hacker? (43:03) - Cool Library: Render a DOM Element as an Image (45:04) - Cool Tool: Pages CMS Runs on Top of Your Git Repo (47:08) - The Minnesota Long Goodbye NewsSocket.dev covers Shai-Hulud: Updated and Ongoing Supply Chain Attack Targets CrowdStrike npm Packages Popular Tinycolor npm Package Compromised in Supply Chain Attack What the npm package attacks mean for us developersWasm 3.0 spec completedAnnouncing AshTypeScript, part of the Ash Framework (Phoenix/Elixir)ts-to-zod now supports Zod 4.0Typebox 1.0 releaseFrom the CommunitySquiggleConf Happened! Check out the streams (separate videos to come)Day 1: https://www.youtube.com/live/C_ePbVZqXrw?si=MpRiE8n4xLNpfbV0Day 2: https://www.youtube.com/live/vSXLDvvIpYE?si=cWKQTjZCx91HWJN9Federico (AzraelSec): Type Branding in Typescript Renato: TypeScript Tuple Length Evan Hahn: @ts-ignore is almost always the worst optionRoadmap.sh: Everything You Need to Learn to be a TS DevGitHub Actions can now run pure TS on Node 22/24 runners without a build step (h/t Brian Muenzenmeyer)Mathew Brown: Using Node's Test Runner with Typescript & React Library Watch: Combinatorial CLI opt parsingLibrary Watch: Introducing: @traversable/valibot (h/t Andrew Jarret)Tool watch: FullStacked, a local-first app development environmentTool watch: Roguestrad, a Retro 3D Game engine forked from DOOM-3-BFG with TypeScript scripting supportCool StuffFunny Read: Is your son a computer hacker?Cool Lib: dom-to-image-more – render DOM elements as imagesCool Tool: Pages CMS - Hassle-free CMS for static sites powered by Git Sponsored by Excalibur.jsExcalibur.js is the friendly TypeScript game engine for making 2D web games. Use your TypeScript or JavaScript skills to make games! Excalibur comes out-of-the-box with everything you need to make web games, like physics, sprites, animations, sound effects, input, and particles. Design your assets with tools like Aseprite and Tiled, then load them natively using first-party plugins.MusicSeahorse Dreams by Kubbi (Spotify)