
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Demo: https://hype.tolin.ski/
Take a look. It's nothing special yet, but it has potential.
Hype is a meta framework for easily and quickly building hyperfast websites and apps with HTMX & Bun.
This repo is currently both a demo and the platform itself. The platform will eventually evolve into just packages and the demo will move elsewhere.
This is trying to be a battery buddy of a framework. It holds your batteries. It's batteries included.
🔋 So what are those batteries
✅ Server Routing Via ElysiaJS
✅ Database & ORM via Drizzle (sqlite easy ootb)
✅ HTML & JavaScript as template engine
✅ File based routing without pain
✅ Browser live reload
✅ Markdown File Routes
✅ HTML File Routes
⌛ Animations
⌛ A legit default template with easy mods and overrides
⌛ Easy Tailwind / Uno
⌛ Layouts
⌛ Auth
⌛ Form Generation
⌛ Admin
⌛ Swapable Templating Langs
⌛ Client side helpers
⌛ Scoped CSS
Zero build, extreme speeds, no OOTB client side framework JS. Trying to keep deps super low here.
Poke around but just know that nothing is final.
HTMX is sick and there are a ton of competing stacks and frameworks to use it in. This is trying to be THE JavaScript based way to write HTMX apps with batteries included. Meteor was my favorite framework, so just keep that in mind.
Since args don't rerun components, we can pass a ton of props into them like the entire request and context info. Think Locals for svelte but in your component.
Let's chat https://discord.gg/7eSBjEQMYq
Install: https://marketplace.visualstudio.com/items?itemName=bierner.lit-html
"emmet.includeLanguages": {
"typescript": "html",
"javascript": "html"
},
FAQs

We found that @hype/hype demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.