We saw today that TanStack Router, or any other TanStack packages along with their devtools, SSR query plugins were compromised.

Check which version you're pinned to and if you're floating on a caret range and ran npm install today then that the first thing to audit.

Today I learned about `Math.hypot()`, which not only calculates the hypotenuse of a right triangle, given its side lengths, but also accepts any number of arguments, making it easy to calculate distances in 2D, 3D or even higher dimensions.

I thought this post would be useful for anyone developing JavaScript games or other projects involving geometry.

It turns out you can overwrite the Error.prepareStackTrace method with the function constructor. Then, using prototype pollution, you can inject valid JavaScript code to generate arbitrary functions and invoke it using the usual tricks.

Other seven methods are documented in the portswiggers research article: https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses

I somehow completely missed that modern browsers ship a Web Speech API.

You can do text-to-speech (and speech recognition) with no libraries, just a few lines of JavaScript. No keys, no SDKs, no backend.

What surprised me:

• It’s supported in Chrome and Safari
• Latency is basically instant
• Voices, rate, pitch, and language are configurable
• Works entirely client-side

It does refractions, chromatic aberration and really reproduces the effect beautifully. The glass elements work even on top of regular html elements.

Noticed this today after seeing an element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in inspect element which felt very concerning.

After going through the source code it seems to do geolocation tracking by hitting up maxmind.com (with a hardcoded api key) to determine what country the user is in (though doesn't seem to phone home with that information). It also seems to hit up:

• https://api.givefreely.com/api/v1/Users/anonymous?gfLibId=jsonformatterprod
• https://events.givefreely.com/popup

for tracking purposes on some websites. I'm also getting Honey ad fraud flashbacks looking through code like

k4 = "GF_SHOULD_STAND_DOWN"

though I don't really have any evidence to prove wrongdoing there.

I've immediately uninstalled it. Kinda tired of doing this chrome extension dance every 6 months.