Joined March 2012
534 Photos and videos
Thomas Belin retweeted
SECURITY ADVISORY — TanStack npm packages A supply-chain compromise affecting 42 @tanstack/* packages (84 versions total) was published to npm earlier today at approximately 19:20 and 19:26 UTC. Two malicious versions per package. Status: ACTIVE — packages are deprecated, npm security engaged, publish path being shut down. Severity: HIGH — payload exfiltrates AWS, GCP, Kubernetes, and Vault credentials, GitHub tokens, .npmrc contents, and SSH keys. If you installed any @tanstack/* package between 19:20 and 19:30 UTC today, treat the host as potentially compromised: • Rotate cloud, GitHub, and SSH credentials immediately • Audit cloud audit logs for the last several hours • Pin to a prior known-good version and reinstall from a clean lockfile Detection — the malicious manifest contains: "optionalDependencies": { "@tanstack/setup": "github:tanstack/router#79ac49ee..." } Any version with this entry is compromised. The payload is delivered via a git-resolved optionalDependency whose prepare script runs router_init.js (~2.3 MB, smuggled into each tarball at the package root). Unpublish is blocked by npm policy for most affected packages due to existing third-party dependents. All 84 versions are being deprecated with a SECURITY warning, and npm security has been engaged to pull tarballs at the registry level. Full technical breakdown, complete package and version list, and rolling status updates: github.com/TanStack/router/i… Credit to the security researcher for responsible disclosure.
138
979
3,853
3,905,347
Thomas Belin retweeted
The future of Three.js is WebAssembly
152
428
5,362
649,256
Thomas Belin retweeted
New blog post! Let's move to ESM! 😈 antfu.me/posts/move-on-to-es…

18
90
669
64,233
Thomas Belin retweeted
Are you using tsx to import source files across workspace packages? You may be making expensive trade-offs without realizing it Here's a breakdown of the risks and better alternatives: 👉 hirok.io/posts/importing-sou…
2
6
19
2,616
22 Oct 2024
It just occurred to me that I am, regularly, reading the most rust-themed children's book ever to my 1.5y-o son: "don't `panic!` little crab" He got an early kick start into rust 😎 #rust
3
209
Thomas Belin retweeted
7 Sep 2024
Hot take: singleton is an anti-pattern.
21
3
30
10,755
3 Sep 2024
After 2 weeks using only @zeddotdev (switching from vscode), I can say that I really like it. It feels so snappy and responsive!! I can only recommend giving it a try ✨
1
1
154
Thomas Belin retweeted
I just wrote a massive guide to creating and publishing a package on npm. It goes from an empty directory to a production-ready setup. It's over 4,000 words, and has a 14-minute walkthrough video. Want the juicy bits? Time for a thread 👇 🧵
41
203
2,034
118,704
Thomas Belin retweeted
1 Aug 2024
📚 I like xstate/store so much that I will probably use it over zustand the next chance I get. I wrote about the reasons in this blog post: tkdodo.eu/blog/introducing-x…
34
43
433
88,441
Thomas Belin retweeted
📝 JavaScript garbage collection doesn't work how I expected when it comes to closures. TIL! jakearchibald.com/2024/garba…
40
144
815
75,303
Thomas Belin retweeted
Useful thing to remember when climbing the ladder: The people above you are not as good as you think they are. No one is supernatural.
9
15
167
11,924
Thomas Belin retweeted
27 Jul 2024
Replying to @passle_
Folks you probably want to actually get the update from my personal blog which INCLUDES UPDATES: lirantal.com/blog/zero-depen… Sadly, the hashnode syndication is unhelpful because it doesn't pick up on edits I push on my own blog
2
5
2,682
Thomas Belin retweeted
TypeScript 5.6 beta brings a sweet new feature - the ability to spot faulty logic in your if statements. SO many subtle will be prevented by this. Really nice stuff.
19
46
580
33,937
Thomas Belin retweeted
📜 DRY – the common source of bad abstractions - @Swizec Greatly illustrates how React devs could end up creating the wrong abstraction Popular React UI libraries learned over the year to not over-abstract, giving you more flexibility swizec.com/blog/dry-the-comm…
2
4
37
4,937
Thomas Belin retweeted
Okay, listen. If you're going to fetch in useEffect(...), you should at least make sure that you're handling: - Loading states - Error handling (rejections & HTTP error codes) - Race conditions & cancellation This isn't over-engineering. It's the minimum code to prevent bugs.
75
159
1,532
140,634
Thomas Belin retweeted
Playing guitar tablatures in Rust agourlay.github.io/ruxguitar…

3
17
2,571
Thomas Belin retweeted
20 Jul 2024
✍️ New Guide: CSS Grid Areas I wrote a new ✨ interactive ✨ guide that explores CSS grid areas, line numbers, line names, and includes many interactive examples to experiment with. Happy learning! 🔗 ishadeed.com/article/css-gri…
17
227
1,510
118,399
Thomas Belin retweeted
18 Jun 2024
A Zod misuse I've noticed: Validating function args. Zod is for validating runtime input: - URL params - HTTP Responses - localStorage - Cookies - Reading from files Avoid using Zod to validate function args. The args are already strongly typed by TypeScript itself.
48
46
751
185,535
Thomas Belin retweeted
Here's a beautiful piece of TS code to get the indexes of any 'as const' array.
13
38
617
79,834