Kevin Gibbons
478 posts

Kevin Gibbons
@bakkoting
JavaScript, TC39, language design, math. I try to avoid twitter, but some conversations only happen here.











Bun and Node.js docs have conflicting info about the node:vm module. Bun claims it to be suitable for untrusted code execution, while official Node.js docs explicitly say in red that it cannot be used for untrusted code execution. So what’s up with node:vm in Bun? @jarredsumner









🚨 Major active supply chain attack just hit npm. Popular package @ctrl/tinycolor was trojanized — and it didn’t stop there. Over 40 packages were silently modified to steal secrets from dev machines & CI pipelines. Our team at Socket caught it. Full report coming soon. Stay safe out there.


Each time I open up an old JS project, I get dozens of breaking changes when I update npm packages. It's wonderful that all these open source projects are actively supported, but the tradeoff is every app that uses npm quickly "rots".




ECMAScript excitement 😉 TC39 advanced: 4️⃣ Math.sumPrecise 4️⃣ Uint8Array ↔️ base64/hex 3️⃣ Iterator Sequencing 3️⃣ Upsert 3️⃣ Immutable ArrayBuffer 2️⃣.7️⃣ Intl Era/Month Code 2️⃣ Import Bytes 1️⃣ Module Global 1️⃣ Array.getNonIndexStringProperties 1️⃣ Object.getOwnPropertySymbols opts










