Yes it does. A fantastic conference from @swmansion and @expo — so glad to take part. What an inspiring week of content, connection and camaraderie. Great to see everyone!
From @aurorascharff, ClickLight is awesome.
Super cool -- even when not presenting -- to have a nice visual on where your mouse is and it's just fun besides.
Love it!
https://t.co/Ghlzf7SckH
I don’t know who needs to hear this but *pinch* of baking soda stops almond milk from curdling in coffee. It brings down the acidity that curdles the milk.
Just open-sourced a new template for building AI chatbot apps like Claude with Expo Router!
⬦ Runs on iOS, Android, and web
⬦ Stream any model with AI SDK
⬦ Tailwind styles for theming
⬦ Smooth keyboard handling
⬦ Liquid Glass and iOS 18
Link below ↓
SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.
if you're in or near prague, check out the @expo x @strvcom hackathon this friday (may 1)!
💡 the idea: pick a business that you care about that either doesn't have an app or whose app desperately needs to be replaced, then build the best app you can in a day.
🏆 prizes: 10k in expo credits! tickets to app.js conf! get featured on expo blog and socials. and more.
🤷♂️ folks from our team (@sethwebster@davidmokos_ Adam Zvada and @joe_d_ryan) will be on site to help out!
As I shared in my talk yesterday at @ReactMiamiConf only short-sighted leaders are laying off staff for efficiency gains at this point.
🤖 will drive a natural correction but layoffs en masse signal missing the true opportunity: do way more with way more.
Congrats to the team behind @ReactMiamiConf (esp. @MichelleBakels) for putting on such an amazing event.
Amazing to be in a room with so many extraordinary builders. Finally got here and got to meet @gabegreenberg!