Walshy

Programmer, data collector, #Bitcoin supporter. Working at @Cloudflare on solving the hard issues (tweets don't reflect my employer - you know the gist)

[Walshy @WalshyDev]

@QuinnyPig @AnthropicAI @Cloudflare UI bug, fixing!

[Walshy @WalshyDev]

@WallisDev @CloudflareDev Far far from it sadly :(

[Walshy @WalshyDev]

I've been working on a registry-gateway built on @CloudflareDev Workers due to previous compromises like this.

This is reenforcing my belief that every company will need to have this in the future.

The gateway will:
* Enforce a cooldown period for new versions (similar to how pnpm does it but at a gateway level this enforces it globally and supports ALL package managers)
* Allows blocking packages or package prefixes
* Logs all downloads
* Clone all packages into R2 - this is to avoid any package being replaced and compromised that way. We know byte for byte this will not change (while I don't believe any registries allow this anymore, it's defence in depth)

My gateway currently works for npm and Golang is mostly done now too.
Rust is next up.

I truly believe the future is Enterprises all having their own registry gateways and enforcing security that way.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Nevi Shah @nevikashah]

🤸‍♀️You can now get a single unified trace of your Worker across service bindings and Durable Object calls 🤸‍♀️

no more manually piecing together multiple traces to see what’s happening within a request

[Walshy @WalshyDev]

@CherryJimbo nah can't give agents credit for all my awesome code

[Walshy @WalshyDev]

@just_some_dev Ooooooo!!!
Go to the Cloudflare office, @nevikashah can show you around

The view is absolutely stunning!

[Walshy @WalshyDev]

We finally did it!

Email Sending is available for customers!!

This has been one of the biggest feature requests for us for a very long time, super super happy it is now available

Huge congrats to the team for shipping this!

[Thomas Gauvin @thomasgauvin]

The wait is over. Cloudflare Email Service is now in public beta 📧

Send and receive emails directly from Workers or REST API with global delivery on Cloudflare's network

And just in time for you to build email agents with the Agents SDK!

[Thomas Gauvin @thomasgauvin]

The wait is over. Cloudflare Email Service is now in public beta 📧

Send and receive emails directly from Workers or REST API with global delivery on Cloudflare's network

And just in time for you to build email agents with the Agents SDK!

[Walshy @WalshyDev]

@CherryJimbo Hey I'm not the one who has a falling out with my agents 😂😂

[Walshy @WalshyDev]

When you're too emotionally attached to your AI agent:

[Walshy @WalshyDev]

I'm gonna be at @Cloudflare Connect tomorrow in London manning the Community Booth!

Let me know if you're gonna be around and definitely come say hi :)
Especially if you don't already know about our awesome communities!

[Walshy @WalshyDev]

@_ashleypeacock @Cloudflare Hell yeah, welcome!

[Cloudflare @Cloudflare]

We’re introducing Dynamic Workers, which allow you to execute AI-generated code in secure, lightweight isolates. This approach is 100 times faster than traditional containers. https://t.co/c36Vkb7I0R

[Walshy @WalshyDev]

@zebassembly Happy birthday you legend!

[Walshy @WalshyDev]

@StopForumSpam @CloudflareDev oh that's fun.. will get it fixed!
cc: @BraydenWilmoth

[Walshy @WalshyDev]

Last week, I broke production on a personal Cloudflare Workers project with a bad change.

To ensure that never happens again and so I can rollout with confidence, I built CanaryRoll - a fully managed Gradual Deployment system for @CloudflareDev Workers

Link & how I built ⬇️

[Walshy @WalshyDev]

@StopForumSpam @CloudflareDev Well, retro active apologies and glad we fixed 😅

[Walshy @WalshyDev]

@ericclemmons ayyy great to hear. Yeah I'm just using API tokens right now from the user, I want to setup an OAuth client for it but it's a tad pain right now