project
Bun is a fast all-in-one JavaScript/TypeScript runtime, bundler, test runner, and package manager built as an alternative to Node.js.
No evidence-backed relationships are recorded.
Vercel Labs' experimental ScriptC compiles TypeScript to native binaries that started in 1.78ms against Node's 61.78ms in one benchmark. The gain holds for short, statically typed programs, while framework code and sustained compute both ran slower than Bun or Node.
Reality
Socket says workflows using issues-helper@v2.2.1 re-ran Mini Shai-Hulud after the Action was re-enabled on September 16 with its malicious tags intact. The earlier takedown only made those jobs fail, so the fix that holds is dropping the Action or pinning a verified commit SHA.
Reality
September's wave altered more than 500 npm package versions and November's backdoored 796, both by republishing under a fresh version number, which is exactly the thing an exact pin declines to fetch.
Reality
Exact-substring scoring put a developer's 700-line RAG tool at a 65% retrieval hit-rate at k=3, 13 points below what a token-overlap scorer found. The bug also made extra retrieved chunks look worthless, and a 20-question test set added 15 points of noise.
Reality
Six engineers shipped a fully native Shop app in 12 weeks, but the first attempt at handing the React Native code to a model produced what Shopify's engineering director called slop. Helix chunks each screen instead.
Perspective Coverage
5 publishersReality
Stephen Toub of Microsoft writes that AI agents wrote most of the code and a single developer drove the port in a few months while the rest of the team kept expanding the runtime. The post puts the speedup at orders of magnitude.
Reality
TC39's iterator helpers are Baseline as of September 2026, so lazy chains run without a polyfill from Chrome 122 and Node 22 upward, while the teams reporting the 40-60% memory saving attached to them are unnamed.
Reality
Of the ten code migrations Anthropic says finished in a month, only one carries a dollar figure: 5.9 billion input tokens and 690 million output tokens, a million lines of Rust, about 16.5 cents a line.
Reality
Deno 2.9 adds an experimental deno desktop command that compiles a web app into a single binary. The default backend bundles no browser engine, so rendering follows WebView2 or WebKit. Bundling Chromium is a flag away, at tens of megabytes.
Reality
Jarred Sumner's four-month rewrite checked transpiled Rust against a TypeScript suite that does not depend on the implementation language, and reaching a fully passing run cost about $165,000 in tokens.
Reality
Bun's port from Zig to Rust landed in four months because its test suite was written in TypeScript, independent of the language underneath, and because separate agents wrote the code and reviewed it.
Reality
One MIT-licensed proxy on localhost is enough to serve OpenAI's own desktop client from self-hosted models. The models that fail there fail on Codex's tool-call format. One of three tested got lost.
Reality
myc is an MIT-licensed memory layer for coding agents that installs into Claude Code's PreCompact event, writes the raw session to disk before it prints anything back, and hides the decisions it extracts until a human confirms them.
Reality
Size was the only reason to pick Tauri over Electron for this app, and the discount is real. What you take on in exchange is a second process whose lifetime and paths you now manage from Rust.
Reality
Four core SAP build packages shipped an identical 11.6MB credential stealer. Because npm trusted the whole cap-js repository rather than one branch, a commit pushed to an unused branch was enough to publish them.
Reality
Safari's loader took its host hooks from a proposal last updated in January 2016, which is why the top-level await bugs survived years of patching, and why the rewrite only helps traffic already on Safari 27.
Reality
Safari's "accessed before initialization" errors came from host hooks specified in a proposal last touched in 2016, before async/await existed in the language. WebKit rebuilt the loader rather than patch it again.
Reality
The Rust rewrite keeps pnpm 11's commands and lockfile, so adopting it costs little more than pulling from the next-12 tag, but the headline percentage describes a 1.5-second install and the cold case improved by about two thirds.
Reality
An unofficial open-source CLI captures Slack session tokens through an ordinary browser login and writes them to disk. The approval step it removes was the one place anyone else got a look.
Reality
Oh-My-Pi makes a write conditional on the target lines still hashing the same, so the loser of a race gets an error instead of a wrecked file. The guarantee is paid for in retries.
Reality
Build · August 22, 2026 · 1 publisher
Security · August 21, 2026 · 1 publisher
Security · August 20, 2026 · 1 publisher
Build · August 18, 2026 · 1 publisher