eskimojo

Redux Toolkit co-maintainer, and creator of and banner by @popurri_arts

he/him

previously @EskiMojo14

[eskimojo @eskimojo]

quoting this to pin it 😎

[Popurri 💕 COMMISSIONS OPEN @popurri_arts]

Fullbody commission for @eskimojo 🐏✨ thank you so much! 💖 #brigitte #mitzi #OverwatchFanart

[eskimojo @eskimojo]

@wesbos round corners are overrated

[eskimojo @eskimojo]

@cupidjuno @lnrhush especially since the original artist already posted here, it's not hard to just retweet
https://t.co/tHiNwMpdkh

[JB✏️ @breikka]

2B Kiriko 🖤
#NierAutomata #Overwatch #OverwatchFanart

[eskimojo @eskimojo]

@FabianHiller @stanzillaz @colinhacks valibot more like smellybot
boom roasted

[eskimojo @eskimojo]

@Saadeghi you can't write html in JS files 🤷‍♂️

[eskimojo @eskimojo]

@Saadeghi almost like they're properties not attributes
https://t.co/tR26cSpWZe

[Mark Erikson @acemarke]

It's Redux release day! Shipped RTK 2.12.0, React-Redux 9.3.0, and Reselect 5.2.0

Highlights:

- RTK skills files
- `connect` is officially deprecated! Don't use it! :)
- Fixed trusted publishing

https://t.co/GG4dfQz76j

https://t.co/4nH7E3zNzd

https://t.co/6G4ePeoIkQ

[eskimojo @eskimojo]

@artman @linear https://t.co/lVyOqbtbeI
🤷‍♂️

[eskimojo @eskimojo]

@TheAlexLichter @ron_mizrahio @Swizec (tsdown for packages and vite for apps in a trenchcoat)

[eskimojo @eskimojo]

@ron_mizrahio @Swizec

[eskimojo @eskimojo]

@ron_mizrahio @Swizec tsdown for packages, vite for apps

[eskimojo @eskimojo]

@zeeg https://t.co/lVyOqbtbeI
i'm too specpilled for this conversation

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[eskimojo @eskimojo]

@disciplinds @OleVestre what scott pilgrim ass plot is this

[eskimojo @eskimojo]

@disciplinds @pissshit90001 nay

[eskimojo @eskimojo]

@disciplinds @pissshit90001 hayfever because i have it now and i don't think you grow out of it

[eskimojo @eskimojo]

@lukeed05 @rolldown_rs i use macros to hardcode the version of the package I'm benchmarking:
https://t.co/ggOjDqDgSb
https://t.co/xsSkBpEIs0

[eskimojo @eskimojo]

@mmkalmmkal just added benchmarks for Type.Script - for equivalent schemas (compiled with Rolldown, minified and gzipped):
Valibot - 1.96 KB
zod/mini - 5.04 KB
Type.Object (etc.) + Schema.Parse - 12.53 KB
zod - 17.04 KB
Type.Script + Schema.Parse - 26.52 KB

[eskimojo @eskimojo]

@mmkalmmkal typebox is definitely cool, but i don't think it's smaller than valibot or zod/mini
https://t.co/poV8ZNZtPB

[eskimojo @eskimojo]

@kentcdodds https://t.co/GfTZRERkQv

[eskimojo @eskimojo]

@kettanaito @mbetts you would also run into issues if your type checker has to type check packages as well - it would be a lot slower, and there's no guarantee they're following the same tsconfig you are (e.g. you'd get noUncheckedIndexedAccess issues if they don't use it and you do)