Email: Bytes: The largest supply chain attack in history

Subject:
Bytes: The largest supply chain attack in history
Received:
9/9/2025, 9:43:32 PM
From:
"Tyler from ui.dev" <tyler@ui.dev>
To:
desert.legend.57@rss.andrealin.it
&lt;!DOCTYPE html&gt;
&lt;html&gt;
&lt;head&gt;
&lt;title&gt;Bytes: The largest supply chain attack in history&lt;/title&gt;
&lt;meta charset="utf-8"&gt;
&lt;meta name="viewport" content="width=device-width, initial-scale=1.0"&gt;
&lt;meta name="color-scheme" content="light dark"&gt;
&lt;meta name="supported-color-schemes" content="light dark"&gt;
&lt;link href="https://fonts.googleapis.com/css2?family=Fira+Mono&amp;family=Outfit:wght@400;500;700;900&amp;family=Paytone+One" rel="stylesheet"&gt;
&lt;style&gt;@media (prefers-color-scheme: dark) {
  .email-wrapper {
    color: #F9F4DA !important;
    background-color: #0F0D0E !important;
  }
  hr {
    border-color: #262422 !important;
  }
  mark {
    background-color: #231F20 !important;
    color: #F9F4DA !important;
  }
  pre {
    background-color: #231F20 !important;
    border: 1px solid #231F20 !important;
    color: #F9F4DA !important;
  }
  .bg-alt {
    background-color: #231F20 !important;
  }
  .unsubscribe-link {
    color: #504C48 !important;
  }
  .token.punctuation {
    color: #f9f4da !important;
  }
}
@media screen and (min-width: 600px) {
  .mobile-break {
    display: none;
  }
}&lt;/style&gt;
&lt;meta http-equiv="Content-Type" content="text/html; charset=UTF-8"&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;table class="email-wrapper" border="0" cellspacing="0" width="100%" style="background-color: #FFF; border-collapse: collapse; color: #231F20; font-family: Outfit, sans-serif; font-size: 16px; width: 100%;"&gt;&lt;tbody&gt;&lt;tr&gt;
&lt;td style="border-collapse: collapse !important; word-break: normal;"&gt;&lt;/td&gt;
&lt;td width="600px" style="border-collapse: collapse !important; width: 600px; word-break: normal;"&gt;&lt;div style="max-width:600px;padding-top:80px"&gt;
&lt;div style="text-align:center"&gt;&lt;img width="600" style="max-width: 100%; padding-bottom: 40px;" src="https://bytes.dev/images/bytes-banner-rounded.png" alt="Bytes"&gt;&lt;/div&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;&lt;strong style="font-weight: 600;"&gt;Today’s issue:&lt;/strong&gt; Animation sacrilege, Fruit Rolldowns, and getting a little too forward about the size of your embeddings.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;Welcome to &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/8ghqh3uol0qwv7hk/aHR0cHM6Ly9ieXRlcy5kZXYvYXJjaGl2ZXMvNDIy" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105709"&gt;#422&lt;/a&gt;.&lt;/p&gt;
&lt;hr style="border: 0; border-bottom: 5px solid; border-color: #f5f5f5; margin-bottom: 100px; margin-top: 100px;"&gt;
&lt;div style="text-align:center;margin-bottom:36px"&gt;
&lt;img width="80" src="https://bytes.dev/images/content/eyes.png" alt="Eyeballs logo" style="max-width: 100%;"&gt;&lt;h2 style="font-family: Paytone One, sans-serif; font-size: 28px; margin-top: 10px; text-transform: uppercase;"&gt;The Main Thing&lt;/h2&gt;
&lt;/div&gt;
&lt;div class="bg-alt" style="background-color: #f5f5f5; border-radius: 16px; margin-bottom: 40px; max-width: 100%; padding: 24px; padding-bottom: 12px;"&gt;
&lt;img src="https://bytes.dev/images/content/misty-cross.jpg" alt="Misty from Pokemon holding up a cross" width="600" style="border-radius: 5px; max-width: 100%;"&gt;&lt;p style="font-family: Outfit, sans-serif; font-size: 15px; font-style: italic; line-height: 1; margin: 0; padding-bottom: 4px; padding-left: 24px; padding-right: 24px; padding-top: 10px; text-align: center;"&gt;Me installing any npm package from now on&lt;!-- --&gt; &lt;/p&gt;
&lt;/div&gt;
&lt;h3 style="font-size: 24px; margin-bottom: 0; padding-left: 24px; padding-right: 24px;"&gt;The largest supply chain attack in history&lt;/h3&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;If you decided yesterday that you wanted to be super productive by logging off social media and updating all your dependencies, I have some very bad news for you.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;Early Monday morning, attackers sent a convincing 2FA-reset phishing email to a prolific OSS maintainer named Qix – and unfortunately, our guy got pwned. This enabled a &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/vqh3hmuopxem76ug/aHR0cHM6Ly9zb2NrZXQuZGV2L2Jsb2cvbnBtLWF1dGhvci1xaXgtY29tcHJvbWlzZWQtaW4tbWFqb3Itc3VwcGx5LWNoYWluLWF0dGFjaw==" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105710"&gt;massive supply chain attack&lt;/a&gt; with malicious patch releases for foundational npm utilities like &lt;code style="font-size: 14px;"&gt;chalk&lt;/code&gt;, &lt;code style="font-size: 14px;"&gt;strip-ansi&lt;/code&gt;, &lt;code style="font-size: 14px;"&gt;debug&lt;/code&gt; and &lt;code style="font-size: 14px;"&gt;color-convert&lt;/code&gt;, which rack up &lt;em&gt;billions&lt;/em&gt; of combined weekly downloads.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;&lt;strong style="font-weight: 600;"&gt;What the malware does:&lt;/strong&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;It’s a “crypto-clipper” that monkey-patches &lt;code style="font-size: 14px;"&gt;fetch&lt;/code&gt;/&lt;code style="font-size: 14px;"&gt;XMLHttpRequest&lt;/code&gt;, scans JSON/text for wallet addresses (ETH, BTC, SOL, etc.), then replaces those legit wallet addresses with one of the attacker’s wallets instead&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;It uses the Levenshtein Distance Algorithm to make sure that the replacement wallet looks visually similar to the original wallet, so that it’s almost impossible to catch&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;If a wallet is present, it intercepts the RPC calls and rewrites the transaction recipient so that it goes straight to the attacker&lt;/p&gt;
&lt;/li&gt;
&lt;/ul&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;Yes, this does give us one more reason to hate crypto bros – but the scary part is that these weren’t some random crypto libraries that were affected. And it follows a similar playbook to last week’s &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/l2heh6ul306q9gi6/aHR0cHM6Ly9ueC5kZXYvYmxvZy9zMW5ndWxhcml0eS1wb3N0bW9ydGVt" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105711"&gt;Nx s1ngularity incident&lt;/a&gt;, where maintainer access gets subverted and developers get burned because of how the open source ecosystem runs on trust.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;Thankfully, the attack was noticed and reported early after a few folks started noticing strange build errors like &lt;code style="font-size: 14px;"&gt;fetch is not defined&lt;/code&gt;. Qix owned the mistake quickly and publicly, and worked with the community and the npm security team to fix the issue. Most of the affected packages are now back to normal.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;And unfortunately for Mr. Robot the Bl4ckh4t, all reports seem to indicate that they walked away with &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/m2h7h6u38gm26khm/aHR0cHM6Ly94LmNvbS92eHVuZGVyZ3JvdW5kL3N0YXR1cy8xOTY1MTI1Mzg5MjQ1OTQwMTcx" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105712"&gt;less than $100&lt;/a&gt;, despite having successfully perpetrated what was arguably the largest supply chain attack of all time. Couldn’t have happened to a nicer guy.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;&lt;strong style="font-weight: 600;"&gt;Bottom Line:&lt;/strong&gt; This all could’ve been way worse, and we’re lucky that it was caught and remedied as quickly as it was. But unfortunately, it’s hard to see the conditions that enable attacks like these changing in a material way anytime soon. And that’s a little frightening.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;&lt;strong style="font-weight: 600;"&gt;Bottom Bottom Line:&lt;/strong&gt; Never check your email, upgrade your dependencies, or leave your house.&lt;/p&gt;
&lt;table width="100%" cellpadding="0" cellspacing="0" border="0" style="border-collapse: collapse; margin-top: 40px; text-align: center;"&gt;&lt;tbody&gt;&lt;tr&gt;&lt;td style="border-collapse: collapse !important; padding-top: 12px; word-break: normal;"&gt;
&lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/dphehmue048d94im/aHR0cHM6Ly9mYWNlYm9vay5jb20vc2hhcmVyL3NoYXJlci5waHA_dT1odHRwcyUzQSUyRiUyRmJ5dGVzLmRldiUyRmFyY2hpdmVzJTJGNDIy" rel="noopener" style="color: #12b5e5; font-weight: 600; padding-left: 5px; text-decoration: none;" target="_blank" url-id="1784105713"&gt;&lt;img alt="" style="display: inline-block; max-width: 100%; width: 32px;" width="25" src="https://bytes.dev/images/fb-share-icon.png"&gt;&lt;/a&gt;&lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/e0hph0u70pqm3li8/aHR0cHM6Ly93d3cubGlua2VkaW4uY29tL3NoYXJpbmcvc2hhcmUtb2Zmc2l0ZS8_dXJsPWh0dHBzJTNBJTJGJTJGYnl0ZXMuZGV2JTJGYXJjaGl2ZXMlMkY0MjI=" rel="noopener" style="color: #12b5e5; font-weight: 600; padding-left: 5px; text-decoration: none;" target="_blank" url-id="1784105714"&gt;&lt;img alt="" style="display: inline-block; max-width: 100%; width: 32px;" width="25" src="https://bytes.dev/images/li-share-icon.png"&gt;&lt;/a&gt;&lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/7qh7h2u9okwd28sz/aHR0cHM6Ly90d2l0dGVyLmNvbS9pbnRlbnQvdHdlZXQvP3RleHQ9QnJlYWtpbmclMjBkb3duJTIwaG93JTIweWVzdGVyZGF5JTI3cyUyMHN1cHBseSUyMGNoYWluJTIwYXR0YWNrJTIwYWZmZWN0ZWQlMjBKYXZhU2NyaXB0JTIwZGV2ZWxvcGVycyZ1cmw9aHR0cHMlM0ElMkYlMkZieXRlcy5kZXYlMkZhcmNoaXZlcyUyRjQyMg==" rel="noopener" style="color: #12b5e5; font-weight: 600; padding-left: 5px; text-decoration: none;" target="_blank" url-id="1784105715"&gt;&lt;img alt="" style="display: inline-block; max-width: 100%; width: 32px;" width="25" src="https://bytes.dev/images/tw-share-icon.png"&gt;&lt;/a&gt;&lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/owhkhwuwrkgxmlsv/bWFpbHRvOj9ib2R5PVRob3VnaHQlMjB5b3UlMjdkJTIwbG92ZSUyMHRoaXMlMjB3ZWVrJTI3cyUyMEJ5dGVzJTBBLS0tJTBBQnJlYWtpbmclMjBkb3duJTIwaG93JTIweWVzdGVyZGF5JTI3cyUyMHN1cHBseSUyMGNoYWluJTIwYXR0YWNrJTIwYWZmZWN0ZWQlMjBKYXZhU2NyaXB0JTIwZGV2ZWxvcGVycyUwQWh0dHBzJTNBJTJGJTJGYnl0ZXMuZGV2JTJGYXJjaGl2ZXMlMkY0MjImc3ViamVjdD1Zb3UlMjBsaWtlJTIwY29ybmJyZWFkJTNG" rel="noopener" style="color: #12b5e5; font-weight: 600; padding-left: 5px; text-decoration: none;" target="_blank" url-id="1784105716"&gt;&lt;img alt="" style="display: inline-block; max-width: 100%; width: 32px;" width="25" src="https://bytes.dev/images/em-share-icon.png"&gt;&lt;/a&gt;
&lt;/td&gt;&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;
&lt;hr style="border: 0; border-bottom: 5px solid; border-color: #f5f5f5; margin-bottom: 100px; margin-top: 100px;"&gt;
&lt;div style="text-align:center;margin-bottom:36px"&gt;
&lt;img width="150" src="https://bytes.dev/images/content/convex-logo.png" alt="Convex logo" style="max-width: 100%;"&gt;&lt;h2 style="font-family: Paytone One, sans-serif; font-size: 28px; margin-top: 10px; text-transform: uppercase;"&gt;&lt;span&gt;Our Friends &lt;br class="mobile-break"&gt;(With Benefits)&lt;/span&gt;&lt;/h2&gt;
&lt;/div&gt;
&lt;div class="bg-alt" style="background-color: #f5f5f5; border-radius: 16px; margin-bottom: 40px; max-width: 100%; padding: 24px; padding-bottom: 12px;"&gt;
&lt;img src="https://bytes.dev/images/content/sponge-leg.jpg" alt="Spongebob showing off his leg" width="600" style="border-radius: 5px; max-width: 100%;"&gt;&lt;p style="font-family: Outfit, sans-serif; font-size: 15px; font-style: italic; line-height: 1; margin: 0; padding-bottom: 4px; padding-left: 24px; padding-right: 24px; padding-top: 10px; text-align: center;"&gt;When you build your entire backend with TypeScript&lt;!-- --&gt; &lt;/p&gt;
&lt;/div&gt;
&lt;h3 style="font-size: 24px; margin-bottom: 0; padding-left: 24px; padding-right: 24px;"&gt;&lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/z2hgh7ue34p528sp/aHR0cHM6Ly93d3cuY29udmV4LmRldi8=" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105717"&gt;Convex is the missing half of your React app&lt;/a&gt;&lt;/h3&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;Their all-in-one backend platform provides everything you need to build, launch, and scale a production-ready backend.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;The best part? It lets you use TypeScript to write &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/p8hehqu4z3grw7aq/aHR0cHM6Ly9kb2NzLmNvbnZleC5kZXYvZnVuY3Rpb25zL3F1ZXJ5LWZ1bmN0aW9ucy8=" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105718"&gt;queries as code&lt;/a&gt; that are automatically cached and realtime, with a &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/x0hph3uewr9kvnb5/aHR0cHM6Ly9kb2NzLmNvbnZleC5kZXYvZGF0YWJhc2U=" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105719"&gt;reactive database&lt;/a&gt; that’s built for AI apps.&lt;/p&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;It also gives you:&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Built-in auth&lt;/li&gt;
&lt;li&gt;File storage&lt;/li&gt;
&lt;li&gt;&lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/6qhehoul7knx87io/aHR0cHM6Ly93d3cuY29udmV4LmRldi9jb21wb25lbnRzL2FnZW50" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105720"&gt;AI agent component&lt;/a&gt;&lt;/li&gt;
&lt;li&gt;Server functions&lt;/li&gt;
&lt;li&gt;And so much more…&lt;/li&gt;
&lt;/ul&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;&lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/kkhmh2unld6z0ncl/aHR0cHM6Ly9kb2NzLmNvbnZleC5kZXYvcXVpY2tzdGFydHM=" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105721"&gt;Try one of their Quickstarts&lt;/a&gt; – to instantly get up and running with Next.js, TanStack Start, or pretty much any other framework.&lt;/p&gt;
&lt;hr style="border: 0; border-bottom: 5px solid; border-color: #f5f5f5; margin-bottom: 100px; margin-top: 100px;"&gt;
&lt;div style="text-align:center;margin-bottom:36px"&gt;
&lt;img width="110" src="https://bytes.dev/images/content/spot-the-bug.png" alt="Spot the Bug logo" style="max-width: 100%;"&gt;&lt;h2 style="font-family: Paytone One, sans-serif; font-size: 28px; margin-top: 10px; text-transform: uppercase;"&gt;Spot the Bug&lt;/h2&gt;
&lt;div class="section-presenter" style="margin-bottom:50px;margin-top:15px"&gt;
&lt;h4 style="font-size: 19px; margin-bottom: 0; padding-left: 24px; padding-right: 24px;"&gt;Sponsored by &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/58hvh8ugmvk3dks6/aHR0cHM6Ly93d3cuYXVnbWVudGNvZGUuY29tL2Jsb2cvdXNpbmctdGhlLWF1Z2dpZS1jbGktZm9yLWF1dG9tYXRlZC1jb2RlLXJldmlldy8_dXRtPWJ5dGVz" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105722"&gt;Augment Code&lt;/a&gt;
&lt;/h4&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 16px; line-height: 1.5; margin-top: 5px; padding-left: 24px; padding-right: 24px;"&gt;&lt;em&gt;This article shows how you can &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/58hvh8ugmvk3dks6/aHR0cHM6Ly93d3cuYXVnbWVudGNvZGUuY29tL2Jsb2cvdXNpbmctdGhlLWF1Z2dpZS1jbGktZm9yLWF1dG9tYXRlZC1jb2RlLXJldmlldy8_dXRtPWJ5dGVz" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105722"&gt;turn their Auggie CLI into a PR review bot&lt;/a&gt; that can catch obvious issues automatically and make your code reviews faster and better.&lt;/em&gt;&lt;/p&gt;
&lt;/div&gt;
&lt;/div&gt;
&lt;pre class="language-js" style="background-color: #f9f9f9; border: 1px solid #f9f9f9; border-radius: 8px; color: #231F20; overflow: auto; padding: 24px;"&gt;&lt;code class="language-js" style="font-size: 14px;"&gt;&lt;span class="token keyword" style="color: #f38ba3; font-size: 14px;"&gt;function&lt;/span&gt; &lt;span class="token function" style="color: #9d7dce; font-size: 14px;"&gt;getId&lt;/span&gt;&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;(&lt;/span&gt;&lt;span class="token parameter" style="color: #f38ba3; font-size: 14px;"&gt;user&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;,&lt;/span&gt; fallback&lt;/span&gt;&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;)&lt;/span&gt; &lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;{&lt;/span&gt;
  &lt;span class="token keyword" style="color: #f38ba3; font-size: 14px;"&gt;return&lt;/span&gt; user &lt;span class="token operator" style="color: #12b5e5; font-size: 14px;"&gt;&amp;&amp;&lt;/span&gt; user&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;.&lt;/span&gt;id &lt;span class="token operator" style="color: #12b5e5; font-size: 14px;"&gt;??&lt;/span&gt; fallback&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;;&lt;/span&gt;
&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;hr style="border: 0; border-bottom: 5px solid; border-color: #f5f5f5; margin-bottom: 100px; margin-top: 100px;"&gt;
&lt;div style="text-align:center;margin-bottom:36px"&gt;
&lt;img width="110" src="https://bytes.dev/images/content/cool-bits.png" alt="Cool Bits logo" style="max-width: 100%;"&gt;&lt;h2 style="font-family: Paytone One, sans-serif; font-size: 28px; margin-top: 10px; text-transform: uppercase;"&gt;Cool Bits&lt;/h2&gt;
&lt;/div&gt;
&lt;ol&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;Addy Osmani wrote about &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/25h2h9u32v4lpdi3/aHR0cHM6Ly9hZGR5b3NtYW5pLmNvbS9ibG9nL2Nocm9tZS0xN3RoLw==" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105723"&gt;a history of Google Chrome&lt;/a&gt; for its 17th birthday. It’s really well written, but it might’ve been a little awkward if last week’s anti-trust case had gone differently.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;Sentry is hosting a free workshop on &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/qvh8h8udr7oemqul/aHR0cHM6Ly9sdW1hLmNvbS9jY3J4N2phZQ==" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105724"&gt;Building and monitoring AI agents and MCP servers&lt;/a&gt; that’ll go deep under the hood of MCP monitoring and show how to debug client connection issues, tool call performance, transports, and more. [sponsored]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;Emil Kowalski wrote about how &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/g3hnhwum3d6g8ghr/aHR0cHM6Ly9lbWlsa293YWwuc2tpL3VpL3lvdS1kb250LW5lZWQtYW5pbWF0aW9ucw==" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105725"&gt;you don’t need animations&lt;/a&gt; – which is kind of like the inventor of Coca-Cola saying you don’t need bubbly water, or cola flavoring… or cocaine.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;Apparently it’s birthday week, because GraphQL just turned 10 years old yesterday and launched a fancy new &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/9qhzhdudpqz4v0f9/aHR0cHM6Ly9ncmFwaHFsLm9yZy8=" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105726"&gt;home page&lt;/a&gt;. They’re gonna have to share the funfetti cake we got for Chrome.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;&lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/3ohphdu37o4x5msr/aHR0cHM6Ly93d3cubGVnZW5kYXBwLmNvbS9vcGVuLXNvdXJjZS9saXN0L2FwaS9nZXR0aW5nc3RhcnRlZC8=" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105727"&gt;Legend List just launched v2.0&lt;/a&gt; of their super-fast React Native list library with more accuracy, more speed, sticky headers, and more.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;Nolan Lawson wrote an article to answer the age-old question, &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/n2hohquv386290b6/aHR0cHM6Ly9ub2xhbmxhd3Nvbi5jb20vMjAyNS8wOC8zMS93aHktZG8tYnJvd3NlcnMtdGhyb3R0bGUtamF2YXNjcmlwdC10aW1lcnMv" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105728"&gt;Why do browsers throttle JavaScript timers?&lt;/a&gt; I don’t know, but I’m gonna go ahead and say that it’s IE’s fault.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;JetBrains is hosting &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/48hvh7umr56wdetx/aHR0cHM6Ly9scC5qZXRicmFpbnMuY29tL2phdmFzY3JpcHQtZGF5LTIwMjUvP3V0bV9jYW1wYWlnbj1qc193ZWVrbHlfamF2YXNjcmlwdF9kYXlfMjAyNSZ1dG1fbWVkaXVtPWNwYyZ1dG1fc291cmNlPWJ5dGVzX25ld3NsZXR0ZXI=" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105729"&gt;JavaScript Day 2025&lt;/a&gt; online on October 2nd for free. Tune in for a full day of live Q&amp;A’s and talks from experts like Ryan Carniato, Lydia Hallie, Kent C. Dodds, Victor Savkin, and lots more. [sponsored]&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;Vicki Boykis wrote an article called, &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/wnh2h6uqw5xm22t7/aHR0cHM6Ly92aWNraWJveWtpcy5jb20vMjAyNS8wOS8wMS9ob3ctYmlnLWFyZS1vdXItZW1iZWRkaW5ncy1ub3ctYW5kLXdoeS8=" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105730"&gt;How big are our embeddings now and why?&lt;/a&gt; Sorry Vicki, but my mother taught me not to answer those questions until after the third date.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;Christoph Nakazawa (creator of Jest and former React Native Lead) gave this talk on &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/reh8h9um02wklgs2/aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g_dD0zNnMmdj1yeFBURWtvOEo3Yw==" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105731"&gt;building scalable applications&lt;/a&gt; at last week’s React Universe Conf.&lt;/p&gt;
&lt;/li&gt;
&lt;li&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5;"&gt;kazupon wrote about how his team at Plaid achieved &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/08hwhgu2dogn6lal/aHR0cHM6Ly90ZWNoLnBsYWlkLmNvLmpwL3BlcmYtc2VydmVyLWJ1aWxk" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105732"&gt;87x faster server-side action builds by migrating from Rollup to Rolldown&lt;/a&gt;. That might be true, but you’ve never heard about an 8-year-old kid go crazy after giving themselves a &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/8ghqh3uol0qw67sk/aHR0cHM6Ly93d3cueW91dHViZS5jb20vd2F0Y2g_dj04emVjNTM1TVZaVQ==" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105733"&gt;face tattoo&lt;/a&gt; with a Fruit &lt;em&gt;Rolldown.&lt;/em&gt;&lt;/p&gt;
&lt;/li&gt;
&lt;/ol&gt;
&lt;hr style="border: 0; border-bottom: 5px solid; border-color: #f5f5f5; margin-bottom: 100px; margin-top: 100px;"&gt;
&lt;div style="text-align:center;margin-bottom:36px"&gt;
&lt;img width="110" src="https://bytes.dev/images/content/spot-the-bug.png" alt="Spot the Bug logo" style="max-width: 100%;"&gt;&lt;h2 style="font-family: Paytone One, sans-serif; font-size: 28px; margin-top: 10px; text-transform: uppercase;"&gt;Spot the Bug: Solution&lt;/h2&gt;
&lt;div class="section-presenter" style="margin-bottom:50px;margin-top:15px"&gt;&lt;h4 style="font-size: 19px; margin-bottom: 0; padding-left: 24px; padding-right: 24px;"&gt;Sponsored by &lt;a href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/58hvh8ugmvk3dks6/aHR0cHM6Ly93d3cuYXVnbWVudGNvZGUuY29tL2Jsb2cvdXNpbmctdGhlLWF1Z2dpZS1jbGktZm9yLWF1dG9tYXRlZC1jb2RlLXJldmlldy8_dXRtPWJ5dGVz" style="color: #12b5e5; font-weight: 600; text-decoration: underline;" url-id="1784105722"&gt;Augment Code&lt;/a&gt;
&lt;/h4&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;You can’t mix the nullish coalescing operator &lt;code style="font-size: 14px;"&gt;??&lt;/code&gt; with &lt;code style="font-size: 14px;"&gt;&amp;&amp;&lt;/code&gt; (or &lt;code style="font-size: 14px;"&gt;||&lt;/code&gt;) in the same expression without parentheses.&lt;/p&gt;
&lt;pre class="language-js" style="background-color: #f9f9f9; border: 1px solid #f9f9f9; border-radius: 8px; color: #231F20; overflow: auto; padding: 24px;"&gt;&lt;code class="language-js" style="font-size: 14px;"&gt;&lt;span class="token keyword" style="color: #f38ba3; font-size: 14px;"&gt;function&lt;/span&gt; &lt;span class="token function" style="color: #9d7dce; font-size: 14px;"&gt;getId&lt;/span&gt;&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;(&lt;/span&gt;&lt;span class="token parameter" style="color: #f38ba3; font-size: 14px;"&gt;user&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;,&lt;/span&gt; fallback&lt;/span&gt;&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;)&lt;/span&gt; &lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;{&lt;/span&gt;
  &lt;span class="token keyword" style="color: #f38ba3; font-size: 14px;"&gt;return&lt;/span&gt; &lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;(&lt;/span&gt;user &lt;span class="token operator" style="color: #12b5e5; font-size: 14px;"&gt;&amp;&amp;&lt;/span&gt; user&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;.&lt;/span&gt;id&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;)&lt;/span&gt; &lt;span class="token operator" style="color: #12b5e5; font-size: 14px;"&gt;??&lt;/span&gt; fallback&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;;&lt;/span&gt;
&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 17px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;or even better, just use optional chaining:&lt;/p&gt;
&lt;pre class="language-js" style="background-color: #f9f9f9; border: 1px solid #f9f9f9; border-radius: 8px; color: #231F20; overflow: auto; padding: 24px;"&gt;&lt;code class="language-js" style="font-size: 14px;"&gt;&lt;span class="token keyword" style="color: #f38ba3; font-size: 14px;"&gt;function&lt;/span&gt; &lt;span class="token function" style="color: #9d7dce; font-size: 14px;"&gt;getId&lt;/span&gt;&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;(&lt;/span&gt;&lt;span class="token parameter" style="color: #f38ba3; font-size: 14px;"&gt;user&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;,&lt;/span&gt; fallback&lt;/span&gt;&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;)&lt;/span&gt; &lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;{&lt;/span&gt;
  &lt;span class="token keyword" style="color: #f38ba3; font-size: 14px;"&gt;return&lt;/span&gt; user&lt;span class="token operator" style="color: #12b5e5; font-size: 14px;"&gt;?.&lt;/span&gt;id &lt;span class="token operator" style="color: #12b5e5; font-size: 14px;"&gt;??&lt;/span&gt; fallback&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;;&lt;/span&gt;
&lt;span class="token punctuation" style="color: #231F20; font-size: 14px;"&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;div style="text-align:center;padding-bottom:80px;padding-top:80px"&gt;
&lt;div class="bg-alt" style="background-color: #f5f5f5; border-radius: 16px; margin-bottom: 40px; padding: 24px;"&gt;&lt;div style="margin-top:-40px"&gt;
&lt;img src="https://bytes.dev/images/bytes-icon.png" alt="Bytes" width="55px" style="max-width: 100%; width: 55px;"&gt;&lt;h5 style="font-size:18px;font-weight:400;margin-bottom:24px"&gt;Want us to say nice things &lt;br&gt; about your company?&lt;/h5&gt;
&lt;div style="margin-bottom:16px"&gt;&lt;a style="background-color: #FCBA28; border: 1px solid #231F20; border-radius: 100px; color: #231F20; font-size: 14px; font-weight: 600; padding: 8px 14px; text-decoration: none;" href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/l2heh6ul306qmgb6/aHR0cHM6Ly9ieXRlcy5kZXYvYWR2ZXJ0aXNl" url-id="1784105735"&gt;Sponsor Bytes&lt;/a&gt;&lt;/div&gt;
&lt;div style="margin-bottom:20px"&gt;&lt;a style="color: #FCBA28; font-size: 14px; font-weight: 600; text-decoration: underline;" href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/m2h7h6u38gm2dksm/aHR0cHM6Ly9ieXRlcy5kZXYvc2hhcmU=" url-id="1784105736"&gt;or share it&lt;/a&gt;&lt;/div&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 14px; line-height: 1.5; padding-left: 24px; padding-right: 24px;"&gt;Built with ❤️ by&lt;!-- --&gt; &lt;a style="color: #ed203d; font-weight: 600; text-decoration: underline;" href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/dphehmue048dl4bm/aHR0cHM6Ly91aS5kZXY=" url-id="1784105737"&gt;ui.dev&lt;/a&gt;&lt;/p&gt;
&lt;/div&gt;&lt;/div&gt;
&lt;p style="font-family: Outfit, sans-serif; font-size: 14px; line-height: 1.5; opacity: 0.5; padding-left: 24px; padding-right: 24px;"&gt;50 W Broadway Ste 333 PMB 51647 Salt Lake City, Utah 84101&lt;/p&gt;
&lt;div style="font-family:Papyrus, cursive"&gt;&lt;a class="unsubscribe-link" href="https://click.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov/e0hph0u70pqm8lb8/aHR0cHM6Ly9ieXRlcy5kZXYvdW5zdWJzY3JpYmU=" style="color: #9B9890;" url-id="1784105738"&gt;Unsubscribe from Bytes&lt;/a&gt;&lt;/div&gt;
&lt;/div&gt;
&lt;/div&gt;&lt;/td&gt;
&lt;td style="border-collapse: collapse !important; word-break: normal;"&gt;&lt;/td&gt;
&lt;/tr&gt;&lt;/tbody&gt;&lt;/table&gt;

&lt;span style="display: none"&gt;&lt;a href="https://unsubscribe.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov"&gt;Unsubscribe&lt;/a&gt;&lt;/span&gt;
&lt;!-- --&gt;
&lt;img src="https://open.convertkit-mail4.com/5quqzqpw00b7hngvnl9u6h9k8e444cnhxdov" alt=""&gt;
&lt;/body&gt;
&lt;/html&gt;
Email Content
