Bluesky

👥 Tired of sharing your Font Awesome Pro license like it’s a secret streaming service account? Meet Teams: the smarter, smoother way to collaborate without the chaos.

Add teammates, assign roles, and keep your icons flowing!
Watch the screencast on using teams → youtu.be/j5AhooyKlEM?...

Update: at time of writing Eleventy core (0.x, 1.x, 2.x, 3.x, 4.x prereleases) and our official plugins are still unaffected.

(Compromised package count was updated to 834 from 533 in the latest @socket.dev update)

⚠️ Major Update on the Shai Hulud v2 campaign:

We’ve confirmed 834 malicious packages and now see spillover into Maven Central. The package org.mvnpm:posthog-node:4.18.1 contains the same Bun-based payload used in the npm compromise.

Updated analysis →
socket.dev/blog/shai-hu... #Java

— Socket (November 25, 2025 at 6:43:46 PM UTC)

There is an ongoing npm security event.

At time of writing, Eleventy core and our official suite of plugins are unaffected.

🚨 A new wave of the Shai-Hulud supply chain attack has hit npm, impacting packages across widely used projects from AsyncAPI, ENS, Postman, PostHog, and Zapier. Attackers added a malicious preinstall script following account compromise. The investigation is ongoing:

socket.dev/blog/shai-hu...

— Socket (November 24, 2025 at 1:38:09 PM UTC)

Wondering why your Kit pageviews are mysteriously high?

In Part 1 of our "Doing More with Font Awesome" series, we cover how to:

→ Understand and track Kit usage
→ Identify where those views are coming from
→ Lock it down like a domain wizard 🔐🪄

🎥 Watch the screencast! youtu.be/frdlstifJIQ?...

Web Awesome is, and always will be, free and open source.

We offer a Pro option to sustain the open source project. Pro gets you professionally designed themes, curated color palettes, an ever-expanding pattern library, a theme builder, a powerful CDN, and much more!

Make sure you follow @socket.dev to see the latest in JS supply chain security (we’ll update you if any reports affect Eleventy!)

Some good practices to help mitigate in your projects:

1. Use `npm install --ignore-scripts` (or use pnpm)
2. Use `npm ci` and a package-lock.json on your build server

Web Awesome 3.0.0-beta.6 has just been published to npm.

This version is safe to use, as it pins the affected dependency to the last safe version. You can update to 3.0.0-beta.6 by running the following command:

npm i @awesome.me/webawesome@3.0.0-beta.6

⚠️ SECURITY ALERT: An npm dependency used by Web Awesome was compromised a few hours ago.

This ONLY affects npm installs — CDN users are safe.

DO NOT install Web Awesome via npm right now. New unaffected version is publishing now…

— Web Awesome (September 15, 2025 at 11:33:18 PM UTC)

⚠️ SECURITY ALERT: An npm dependency used by Web Awesome was compromised a few hours ago.

This ONLY affects npm installs — CDN users are safe.

DO NOT install Web Awesome via npm right now. New unaffected version is publishing now…