Claw Patrol, Google I/O, and npm Awakens From Slumber | News | Ep 68

News for the week of May 18, 2026: Claw Patrol! Claw Patrol! We'll be there on the double! Also, npm finally responds to ongoing supply chain attacks. From the community: using Effect more effectively, and AI's impact on open source.

Sponsored by Excalibur.js
Excalibur.js is the free and open source friendly TypeScript 2D game engine for the web. Learn to make web games with TypeScript or JavaScript! Excalibur comes out-of-the-box with everything you need, like physics, sprites, animations, sound effects, and first-party plugins for popular 2D gamedev tools.

• Homepage and Docs: https://excaliburjs.com
• Make Your First Gamein 10 Minutes
• Join the Discord: https://discord.gg/9UemP985Uy

Chapters

• (00:00) - Welcome to the Show
• (05:07) - News: Claw Patrol is an Open Source Security Firewall by Deno
• (06:54) - News: Deno 2.8 Release Notes
• (08:08) - News: Google I/O Takeaways
• (13:26) - News: Firefox 151 Features and Updates
• (16:05) - Security: npm Wakes Up to Supply Chain Attacks
• (21:26) - Security: Laravel Lang Compromised with Backdoor
• (23:00) - Library Watch: mediabunny Works in Your Browser Without ffmpeg
• (24:09) - Library Watch: TSBin is a JSBin Clone for TypeScript
• (25:52) - Community: AI Has Taken Over Open Source by Socket
• (28:53) - Community: Ergonomic Effect by Alex Leung
• (31:47) - Community: Building Your Own Server in Node.js by James Smith
• (33:09) - Bleet of the Week
• (33:37) - Cool Link: Witch Hat Atelier Magic System Simulator
• (34:45) - Cool Link: Stormlight Archives by Brandon Sanderson
• (36:22) - Cool Link: No One's Happy
• (37:22) - The Minnesota Long Goodbye

News

• Deno: Claw Patrol: an open-source security firewall for agents
• Deno: 2.8 blog post
• Google: 15 Updates from Google I/O
  • WebAuthN Immediate Mode: https://github.com/MasterKale/webauthn-polyfills 
• Firefox: Firefox 151.0, See All New Features, Updates and Fixes 
• npm: npm Invalidates Granular Access Tokens as Mini Shai-Hulud Sweeps the Registry 
• Laravel: Laravel Lang Compromised with RCE Backdoor Across 700+ Versions

Library Watch

• Mediabunny: Correction, it does not depend on ffmpeg
• https://tsbin.com/p/new 

From the Community

• Socket: AI Has Taken Over Open Source 
• Alex Leung: Ergonomic Effect
• James Smith: BYO Web Server in Node 
• Bleet of the week

Cool Links

• I Built a Witch Hat Atelier Spell Simulator
• No One’s Happy

Music
Seahorse Dreams by Kubbi (Spotify)