Scott

I like maps

[Scott @sprusr]

Thankfully I missed the compromise window, but even if I had been working during it I think pnpm v11 new defaults would have saved my ass!

[Scott @sprusr]

So I picked a great day yesterday to make my first contribution to TanStack Router 😅

[TANSTACK @tan_stack]

SECURITY ADVISORY — TanStack npm packages
A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package.
Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down.
Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys.
If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised:
• Rotate cloud, GitHub, and SSH credentials immediately
• Audit cloud audit logs for the last several hours
• Pin to a prior known-good version and reinstall from a clean lockfile
Detection — the malicious manifest contains:
"optionalDependencies": {
"@tanstack/setup": "github:tanstack/router#79ac49ee..."
}
Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root).
Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level.
Full technical breakdown, complete package and version list, and rolling status updates:
https://t.co/Zy8qG7PA9f
Credit to the security researcher for responsible disclosure.

[Scott @sprusr]

@neceros Focus of my project is more about displaying/exporting to SVG a map from data of the real world, rather than making the map itself. Azgaar’s fantasy map generator is a really great thing :)

[Scott @sprusr]

Been building a vector map rendering library from scratch. It’s called mewmap and it’s powered by SVG tech built-in to browsers. That allows for pretty small bundle size

[Scott @sprusr]

I started this as a fun project, but the more I’m working on it the more it feels like something serious, legit good alternative for 90% of web map use cases

[Scott @sprusr]

Been building a vector map rendering library from scratch. It’s called mewmap and it’s powered by SVG tech built-in to browsers. That allows for pretty small bundle size

[Scott @sprusr]

Doing a talk next week at HelsinkiJS meetup about maps on the web. Bit of history, bit of future. Hopefully interesting and entertaining!

[Scott @sprusr]

Would probably be best to link to a demo but I didn’t have time to prepare one right now 😅

[Scott @sprusr]

I put together some vector tiles from the new data (for using on web/mobile apps) and a style to go with them https://t.co/1QEurihbVY

[Tom Patterson @MtnMapper]

We are pleased to announce the release of updated Natural Earth v6 transportation data, including roads, railroads, and ferries. A big thank you to Zhaoxu Sui for preparing it. https://t.co/MLG7pkcUbB

[Scott @sprusr]

After that something I’m excited to explore is server-side rendering + possible lightweight isomorphic React wrapper ⚡️

[Scott @sprusr]

Now with raster (satellite) layers working in mewmap 🌍 I think I could probably ship a raster-only version in just a few kb bundle size 🤔

[Scott @sprusr]

I have a small roadmap in the GitHub readme, but next focuses are:

- Symbols (text and icons)
- Rendering from geojson (custom markers)
- Bunch of work to support full Maplibre/Mapbox style spec

[Scott @sprusr]

Can try it out at https://t.co/QUDnK7mvCY but beware it still has a bit of jank in Safari/iOS to figure out

[Scott @sprusr]

General consensus from over here is that it looks a bit goofy with the directives. But will be trying it out and seeing whether I can get it to play nice in cloudflare workers

[Vercel Developers @vercel_dev]

Workflow Dev Kit: reliability-as-code

• "𝚞𝚜𝚎 𝚠𝚘𝚛𝚔𝚏𝚕𝚘𝚠" + "𝚞𝚜𝚎 𝚜𝚝𝚎𝚙"
• Open source and MIT-licensed
• Designed for AI agents and backends
• Backend-agnostic (Vercel or self-hosted)
• Framework-agnostic (Next.js, Nitro & more)
https://t.co/uRzXkbkD3c

[Scott @sprusr]

@Jade_Pickering @emfcamp I’m so pleased you find it useful!

[Scott @sprusr]

Moving to Tokyo tomorrow. That’s pretty cool.

[Pandelis @PandelisZ]

Scariest tiles in monopoly in 2022

[Scott @sprusr]

Going to EMF next week, and also happen to have a spare ticket from a friend who can no longer make it. Free to a good home! 😄

[Scott @sprusr]

@joakimhi It’s actually really good, having games work hasn’t actually been a problem (above was me playing around). Would recommend 👍

[Scott @sprusr]

The Steam Deck is really good

[Scott @sprusr]

@hiMaisie I’m sure I do! I’ll take a look later

[Scott @sprusr]

Found some vintage @AstonHack artefacts at my parents’ house, circa 2015