Ladybird is moving into a new phase as we work toward our first alpha release.
We are tightening how code enters the project: going forward, code changes will only be introduced by project maintainers, and we will no longer accept public pull requests.
https://t.co/iauF4r9f3q
🎉 JSConf JP 2026 is happening!
Japan's JavaScript festival returns for its 7th edition ✨
📅 Sun, Nov 22, 2026
📍 Bellesalle Kanda, Tokyo
Save the date! We'd love to bridge JS developers in Japan and around the world. More 👇
❗️ Over 30 official Red Hat npm packages were compromised. How they got in:
- A Red Hat employee's GitHub account was compromised.
- Attackers pushed "orphan commits" (detached from branch history) straight in, bypassing code review with no pull request.
- Payload "Miasma" (Mini Shai-Hulud variant) steals GitHub/cloud/Vault/SSH/npm secrets. Rotate everything since June 1.
- The commits added a workflow (ci.yaml) + script (_index.js) that abused npm trusted publishing, requesting a real OIDC token to publish backdoored versions.