Thomas Belin

Front-End Architect 🤘

I leave code cleaner than I found it.

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Three.js @threejs]

The future of Three.js is WebAssembly

[Anthony Fu 🦋 @antfu.me @antfu7]

New blog post! Let's move to ESM! 😈
https://t.co/X19bTJmfaB

[Hiroki Osame @privatenumbr]

Are you using tsx to import source files across workspace packages?

You may be making expensive trade-offs without realizing it

Here's a breakdown of the risks and better alternatives:
👉 https://t.co/EiggVCLeuJ

[Thomas Belin @atomrc]

It just occurred to me that I am, regularly, reading the most rust-themed children's book ever to my 1.5y-o son:

"don't `panic!` little crab"

He got an early kick start into rust 😎
#rust

[rniwa.dev @rniwa_dev]

Hot take: singleton is an anti-pattern.

[Thomas Belin @atomrc]

@fkielbasa @zeddotdev Faut bien payer les factures...

[Thomas Belin @atomrc]

After 2 weeks using only @zeddotdev (switching from vscode), I can say that I really like it.
It feels so snappy and responsive!!
I can only recommend giving it a try ✨

[Matt Pocock @mattpocockuk]

I just wrote a massive guide to creating and publishing a package on npm.

It goes from an empty directory to a production-ready setup.

It's over 4,000 words, and has a 14-minute walkthrough video.

Want the juicy bits? Time for a thread 👇 🧵

[🚀 Catalin Ciubotaru 🚀 @c5n_c8u]

Thank you @JoshWComeau for explaining the `useDeferredValue` hook so well.
Nice and clear 🤩.
https://t.co/qzqfLeC2M6

[Dominik 🔮 @TkDodo]

📚 I like xstate/store so much that I will probably use it over zustand the next chance I get. I wrote about the reasons in this blog post: https://t.co/oWAU38VU6Z

[Jake Archibald @jaffathecake]

📝 JavaScript garbage collection doesn't work how I expected when it comes to closures. TIL!

https://t.co/C8Y1S0N3cX

[Matt Pocock @mattpocockuk]

Useful thing to remember when climbing the ladder:

The people above you are not as good as you think they are.

No one is supernatural.

[Liran Tal @liran_tal]

@passle_ Folks you probably want to actually get the update from my personal blog which INCLUDES UPDATES: https://t.co/VS6zLZkMUO

Sadly, the hashnode syndication is unhelpful because it doesn't pick up on edits I push on my own blog

[Matt Pocock @mattpocockuk]

TypeScript 5.6 beta brings a sweet new feature - the ability to spot faulty logic in your if statements.

SO many subtle will be prevented by this. Really nice stuff.

[Seb ⚛️ ThisWeekInReact.com @sebastienlorber]

📜 DRY – the common source of bad abstractions - @Swizec

Greatly illustrates how React devs could end up creating the wrong abstraction

Popular React UI libraries learned over the year to not over-abstract, giving you more flexibility

https://t.co/0UmGfXz6UJ

[David K 🎹 @DavidKPiano]

Okay, listen. If you're going to fetch in useEffect(...), you should at least make sure that you're handling:

- Loading states
- Error handling (rejections & HTTP error codes)
- Race conditions & cancellation

This isn't over-engineering. It's the minimum code to prevent bugs.

[Maxime Chevalier @Love2Code]

Playing guitar tablatures in Rust https://t.co/glz0KFf6Tu

[Ahmad Shadeed @shadeed9]

✍️ New Guide: CSS Grid Areas

I wrote a new ✨ interactive ✨ guide that explores CSS grid areas, line numbers, line names, and includes many interactive examples to experiment with. Happy learning!

🔗 https://t.co/RC0gYk8Sxk

[Thomas Belin @atomrc]

@juuduu @hsablonniere @sardemff7 Ahaha je savais que tu étais derrière tout ça 😛

T'étais en bépo depuis tout ce temps ?

J'avoue, ça me motive bien le ergo-L je vais m'y essayer je pense 😎