
Security News
Another Round of TEA Protocol Spam Floods npm, But It’s Not a Worm
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.


Sarah Gooding
June 26, 2025
The ECMAScript 2025 specification (16th edition of ECMA-262) has been officially approved by the Ecma General Assembly during its 129th meeting in Geneva on June 25, 2025. Shared by TC39 co-chair Rob Palmer on Bluesky, this milestone finalizes the language updates curated by TC39 and signals what’s next for the JavaScript ecosystem.
JavaScript evolves through a formal process led by TC39, a technical committee under Ecma International that reviews, debates, and stages proposals before they become part of the official language spec. Once a set of features reaches Stage 4, meaning they’ve been implemented in two major engines and pass thorough review, they’re eligible for inclusion in the next edition of ECMAScript, the standardized version of JavaScript.
We’ve covered parts of this process in past posts, including Iterator Helpers reaching Stage 4, the standardization of JSON Modules and Import Attributes, and the addition of features like Promise.try, RegExp.escape, and Float16Array. Since ECMAScript 2016, the spec has followed a steady annual release cycle, with a new edition published every June.
Here’s a closer look at what made the cut for the most recent update to the spec:
type: "json", etc.) and bundler/runtime optimizations..map(), .filter(), .take(), etc.) directly on iterators, bringing long-awaited parity with array methods and enabling more expressive lazy evaluation..json files as modules. No more custom loaders. This makes server and toolchain code cleaner and simpler.Promise.try(fn) executes fn and wraps any synchronous errors in a rejected promise. It’s a pattern that’s already widely used in async codebases via utility libraries like Bluebird, now standardized..modifiers property for improved introspection and manipulation.Set.prototype: union, intersection, difference, and symmetricDifference. These mirror mathematical set operations and reduce the need for manual iteration or third-party libs.Many of the ECMAScript 2025 features are already implemented, or partially available, in engines like V8, often behind flags. Some, like Iterator Helpers, are supported in environments such as Deno, or can be polyfilled. For testing and experimentation, transpilers like Babel (as support lands) are good places to try them out.
The final spec is available here: https://tc39.es/ecma262/ and a printable PDF is also available for download.
TC39 notes that the HTML version is the normative copy. (If there's ever a conflict between formats, the HTML defines the official behavior. The PDF is provided for convenience but isn't authoritative.) TC39 recommends reporting issues only if they persist in the latest draft.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now

Security News
Recent coverage mislabels the latest TEA protocol spam as a worm. Here’s what’s actually happening.

Security News
PyPI adds Trusted Publishing support for GitLab Self-Managed as adoption reaches 25% of uploads

Research
/Security News
A malicious Chrome extension posing as an Ethereum wallet steals seed phrases by encoding them into Sui transactions, enabling full wallet takeover.