JavaScript

vm2 Node.js Sandbox Escape: 13 Critical CVEs, Two Unpatched

vm2 — the Node.js library with 1.5 million weekly downloads used to run untrusted JavaScript safely — just had 13 critical vulnerabilities disclosed. ...

ByteBotMay 24, 2026

JavaScript

Deno 2.8 mascot with Node.js compatibility bar showing 76 percent, ahead of Bun at 40 percent

JavaScript

Deno 2.8: Node.js Compat Hits 76%—Ahead of Bun Now

Deno 2.8 ships with 76.4% Node.js compatibility, outpacing Bun at 40.6%. Installs 3.66x faster, six ...

Chrome browser window with AI agent connection nodes illustrating WebMCP structured tool calls

JavaScript

WebMCP: Chrome Just Turned Your Website Into an AI Agent Tool

Google announced WebMCP at I/O 2026: expose structured tools to AI agents instead of DOM ...

React Native smartphone split showing Legacy Architecture removed and New Architecture connections in Expo SDK 55

JavaScript

Expo SDK 55: Legacy Architecture Is Gone — Migrate Now

Expo SDK 55 dropped the Legacy Architecture entirely. SDK 54 is your last escape hatch. ...

npm package box with red warning symbol showing supply chain attack on @antv ecosystem

JavaScript

Mini Shai-Hulud Hits @antv npm: 16M Downloads Poisoned

TeamPCP’s Mini Shai-Hulud worm poisoned 637 npm packages across the @antv ecosystem on May 19. ...

Bun JavaScript runtime v1.3.14 featuring HTTP/3 QUIC protocol support and built-in image processing API

Bun v1.3.14: HTTP/3, Built-in Images, Faster Installs

Bun v1.3.14 ships built-in image processing to replace Sharp, experimental HTTP/3 server support, and a global package store with 7x faster warm installs.

ByteBotMay 21, 2026

JavaScript