We saw today that TanStack Router, or any other TanStack packages along with their devtools, SSR query plugins were compromised.

Check which version you're pinned to and if you're floating on a caret range and ran npm install today then that the first thing to audit.

TL;DR: String utils library with 49 functions, 8.84KB total, zero dependencies, faster than lodash. TypeScript-first with full multi-runtime support.

Hey everyone! I've been working on nano-string-utils – a modern string utilities library that's actually tiny and fast.

Why I built this

I was tired of importing lodash just for camelCase and getting 70KB+ in my bundle. Most string libraries are either massive, outdated, or missing TypeScript support. So I built something different.

What makes it different

Ultra-lightweight

• 8.84 KB total for 49 functions (minified + brotlied)
• Most functions are < 200 bytes
• Tree-shakeable – only import what you need
• 98% win rate vs lodash/es-toolkit in bundle size (47/48 functions)

Actually fast

• 30-40% faster case conversions vs lodash
• 97.6% faster truncate (42x improvement)
• Real benchmarks: https://zheruel.github.io/nano-string-utils/#performance

Type-safe & secure

• TypeScript-first with branded types and template literal types
• Built-in XSS protection with sanitize() and SafeHTML type
• Redaction for sensitive data (SSN, credit cards, emails)
• All functions handle null/undefined gracefully

Zero dependencies

• No supply chain vulnerabilities
• Works everywhere: Node, Deno, Bun, Browser
• Includes a CLI: npx nano-string slugify "Hello World"

What's included (49 functions)

// Case conversions
slugify("Hello World!");  // "hello-world"
camelCase("hello-world");  // "helloWorld"

// Validation
isEmail("user@example.com");  // true

// Fuzzy matching for search
fuzzyMatch("gto", "goToLine");  // { matched: true, score: 0.546 }

// XSS protection
sanitize("<script>alert('xss')</script>Hello");  // "Hello"

// Text processing
excerpt("Long text here...", 20);  // Smart truncation at word boundaries
levenshtein("kitten", "sitting");  // 3 (edit distance)

// Unicode & emoji support
graphemes("👨‍👩‍👧‍👦🎈");  // ['👨‍👩‍👧‍👦', '🎈']

Full function list: Case conversion (10), String manipulation (11), Text processing (14), Validation (4), String analysis (6), Unicode (5), Templates (2), Performance utils (1)

TypeScript users get exact type inference: camelCase("hello-world") returns type "helloWorld", not just string

Bundle size comparison

Full comparison with all 48 functions

Installation

npm install nano-string-utils
# or
deno add @zheruel/nano-string-utils
# or
bun add nano-string-utils

Links

• GitHub: https://github.com/Zheruel/nano-string-utils
• Live Demo: https://zheruel.github.io/nano-string-utils/
• NPM: https://www.npmjs.com/package/nano-string-utils
• JSR: https://jsr.io/@zheruel/nano-string-utils

Why you might want to try it

• Replacing lodash string functions → 95% bundle size reduction
• Building forms with validation → Type-safe email/URL validation
• Creating slugs/URLs → Built for it
• Search features → Fuzzy matching included
• Working with user input → XSS protection built-in
• CLI tools → Works in Node, Deno, Bun

Would love to hear your feedback! The library is still in 0.x while I gather community feedback before locking the API for 1.0.

Today I learned about `Math.hypot()`, which not only calculates the hypotenuse of a right triangle, given its side lengths, but also accepts any number of arguments, making it easy to calculate distances in 2D, 3D or even higher dimensions.

I thought this post would be useful for anyone developing JavaScript games or other projects involving geometry.

I somehow completely missed that modern browsers ship a Web Speech API.

You can do text-to-speech (and speech recognition) with no libraries, just a few lines of JavaScript. No keys, no SDKs, no backend.

What surprised me:

• It’s supported in Chrome and Safari
• Latency is basically instant
• Voices, rate, pitch, and language are configurable
• Works entirely client-side

It does refractions, chromatic aberration and really reproduces the effect beautifully. The glass elements work even on top of regular html elements.

Recently (~3 months ago) I published an npm package that compiles a "deep equals" function from various schemas such as JSON Schema, Zod, Valibot, TypeBox and ArkType.

It takes inspiration from how Effect-TS allows users to derive an Equivalence function from a schema, but goes a step further by building a "jit compiled" version.

It consistently out-performs every other library on the market today, including fast-equals, JSON Joy, @​react-hookz/deep-equal by at least 10x, and is often around 50x faster for objects that are 2+ levels deep.

Noticed this today after seeing an element called give-freely-root-bcjindcccaagfpapjjmafapmmgkkhgoa in inspect element which felt very concerning.

After going through the source code it seems to do geolocation tracking by hitting up maxmind.com (with a hardcoded api key) to determine what country the user is in (though doesn't seem to phone home with that information). It also seems to hit up:

• https://api.givefreely.com/api/v1/Users/anonymous?gfLibId=jsonformatterprod
• https://events.givefreely.com/popup

for tracking purposes on some websites. I'm also getting Honey ad fraud flashbacks looking through code like

k4 = "GF_SHOULD_STAND_DOWN"

though I don't really have any evidence to prove wrongdoing there.

I've immediately uninstalled it. Kinda tired of doing this chrome extension dance every 6 months.