#NPM
npm provenance: How to get a simple and secure release pipeline
https://www.nearform.com/blog/npm-provenance-how-to-get-a-simple-and-secure-release-pipeline/
#ES_Next_News #ECMAScript #JavaScript #npm
#Deno, the runtime for JavaScript and TypeScript, has released version 1.34 which enhances the developer experience and compatibility with #npm and #NodeJS.
https://alternativeto.net/news/2023/5/deno-1-34-released-with-better-compatiblity-with-npm-and-node-js/
Is there a language that handles dependencies well?
Python's virtual environments are a bit awkward but everything mostly works, I haven't played with Java build tools much, Javascript is a trainwreck. I've been happy with Dart, but haven't gotten into the weeds much. Same with rust, cargo seems nice, but I haven't played with it enough to know the pitfalls yet.
#programming #dependencies #python #java #javascript #dart #flutter #rust #cargo #pip #npm #yarn
@jameskoole I am tempted to give #CraftCMS a try since I already have experience with it at my day job and it is a #PHP based CMS. Probably my only hang-up with it is that frontend wise, and even content wise, you have to build it all from scratch. That has it's pros & cons. It did sign-up for #Ghost way back when it first launched. I think the #NodeJS server-side part is probably the biggest turn-off for me. I also manage a #StrapiCMS site and I have to deal with #NPM dependency hell.
Orogene, https://orogene.dev/.
> Orogene is a next-generation package manager for tools that use node_modules/, such as bundlers, CLI tools, and Node.js-based applications. It's fast, robust, and meant to be easily integrated into your workflows such that you never have to worry about whether your node_modules/ is up to date.
It’s really faster than other tools, check the benchmarks, https://github.com/orogene/orogene/blob/main/BENCHMARKS.md.
#JavaScript #RustLang #npm #node_modules #PackageManager #performance
Would love for the #npm / #NodeJS community to follow this and make a “npm-vet” command together with published decentralized audits like these: https://opensource.googleblog.com/2023/05/open-sourcing-our-rust-crate-audits.html
https://marketplace.visualstudio.com/items?itemName=codeandstuff.package-json-upgrade - See upgradable #npm packages in a #Node app and upgrade them visually in #VSCode
Is there a good linter for `package.json` (package exports, etc.)?
#npm #JavaScript #NodeJS
#npm is hiring in the US: Senior Software Engineer, npm at GitHub
https://boards.greenhouse.io/github/jobs/5063280
Released a new very simple 25 lines of code #npm module that validates #conventionalCommits messages in eg. a #husky "commit-msg" #gitHook: https://github.com/voxpelli/validate-conventional-commit
Great for use with eg #releasePlease to achieve #npmProvenance on #GitHubActions
Ich würde gerne selbst Dienste/Apps auf unseren Servern installieren und betreiben können; kann aber mit Befehlen wie #npm-install oder Frameworks wie #nodejs und #Docker-Containern etc. nicht wirklich etwas anfangen. Das scheint mir aber die Grundlage zu sein, den Überblick zu haben.
Ganz konkret habe ich Services im Auge, die unsere Nextcloud mit einem Onlyoffice Server zu ergänzen, ggf. ein Moodle betreiben oder gar eine eigene Mastodon-Instanz hochziehen.
Wo fange ich da am besten an?
4/4
This weekend PyPi, the python software repository, suspended new accounts: the level of malicious activity has become unmanageable.
But this story is not just about Python: the level of risk from software dependencies has risen unimaginably: not a little, not a lot, this is big enough that it is hard to communicate and comprehend.
Python (pypi), Javascript (npm), Java (maven), Ruby, and even VS Code extensions are all under constant unrelenting attack. When a single package is trojanized, that threat is inherited by every application that include the compromised package.
The number of methods being used for these attacks is growing, and developers are now a "target of choice" for many criminal groups.
For example, in 2022 there was a sudden increase in the number of an effectiveness of "Phishing as a Service" (PhaaS) offerings in criminal markets. These services are effective at bypassing MFA. However, you may not know that these services are being used to target developer accounts, including repositories of private and open-source software. They want to trojanize the code and create the next big software-supply-chain compromise.
PhaaS is just one method. This weekend's announcement from PyPi was the result of criminals creating a large number of developer accounts so that they can publish malicious clones of existing packages. Typosquatting of packages is not a new phenomena, the constant stream of attacks is new.
You might assume that the repository hosts or managers must have a solution. They do not. The problems are diverse and many: from the management of repository hosting, to the security/trust verification features of packaging systems, to the security of repositories and the developers themselves.
There is no one solution, but solutions are needed.
My action item for you is this. Do not read cybesecurity about software repository compromises in isolation. Look at the forest and not the trees. Big risks are harder to understand that little ones but need the most urgent action.
Below are a small selection of stories in the comments to get you started. This is just a tiny fraction of the stories I have read and analyzed in the past year. The "hits just keep on coming".
#SoftwareDeveloper #GitHub #PyPi #NPM #Java #Python #CyberSecurity #PhishingAsAService #ThreatIntelligence #CTI #PhaaS #TypoSquatting #VSCode #Malware #SoftwareSupplyChain
https://www.bleepingcomputer.com/news/security/pypi-temporarily-pauses-new-users-projects-amid-high-volume-of-malware/
https://www.zdnet.com/article/security-warning-for-software-developers-you-are-now-prime-targets-for-phishing-attacks/
https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/
https://therecord.media/malware-found-in-npm-package-with-millions-of-weekly-downloads
https://blog.phylum.io/a-pypi-typosquatting-campaign-post-mortem/
https://www.zdnet.com/article/android-warning-these-malicious-apps-had-over-a-million-downloads-from-google-play/
https://www.bleepingcomputer.com/news/security/malicious-microsoft-vscode-extensions-steal-passwords-open-remote-shells/
https://www.bleepingcomputer.com/news/microsoft/vscode-marketplace-can-be-abused-to-host-malicious-extensions/
「開発者向けアラート: Node.js 用の NPM パッケージには危険な TurkoRat マルウェアが隠されています 」： The Hacker News
「不正なパッケージとその関連バージョンのリストを以下に示します。
nodejs-encrypt-agent (バージョン 6.0.2、6.0.3、6.0.4、および 6.0.5)
nodejs-cookie-proxy-agent (バージョン 1.1.0、1.2.0、1.2.1、1.2.2、1.2.3、および 1.2.4)、および
axios-proxy (バージョン 1.7.3、1.7.4、1.7.7、1.7.9、1.8.9、および 1.9.9)
」
https://thehackernews.com/2023/05/developer-alert-npm-packages-for-nodejs.html
@georgeharito @randomgeek @codinghorror Oh, that was just the wake-up call that the script kiddies needed adult supervision. #npm got it in the form of being bought by #Microsoft-owned #GitHub. Careful what you wish for.
The punchline is that @isaacs wrote npm in reaction to how “terribly” #PHP’s #PEAR and #Perl’s #CPAN did package management.
infrastruktur. skal. ikke. og. kan. ikke. "lønne". seg
The idea of publishing npm built-ins (mostly) as-is, is fairly common in relation to tools like browserify.
Those tools can't easily read the source code otherwise and/or the built-in version might not be standalone (eg rely on Node or V8 internals) in a way that would make it work in a browser environment. It also helps control which version is embedded in the build, which otherwise varies by developer env's Node version.
Why would anyone use the `path` package from npm instead of Node’s `path` module?
https://www.npmjs.com/package/path
Just found it in one of my own projects, where I'm the only contributor… 😅
shoutouts for unmoveable dotfiles/dirs go out to:
- vscode
- mozilla
- #npm's cacache (who literally closed my Issue on github about this)
- steam (three times)
- yarn (cache uses XDG_CACHE_HOME, but rc file can't be moved)
- adb (just ignores env var config)
- those .gtkrc files that ignore env var configs
I wrote a dumb article and now you have to suffer me linking to it: https://dev.to/tigt/how-to-succeed-in-open-source-without-really-trying-really-55pj
Import maps, the new browser standard, open up a world of possibilities for factoring and optimizing web pages and experiences. In this post, we explore one of them briefly: developing a static import-map-based #CDN to serve your #NPM packages. (https://bennypowers.dev/posts/import-map-cdn/)
Hrm, #npm really needs a filter for "still maintained" because there's an utterly ridiculous number of packages that are just no longer maintained, which would be really good to filter from search results
So 5 years ago @joshbressers and I discussed the #NPM #leftpad situation https://opensourcesecurity.io/2023/05/07/episode-374-the-event-we-called-left-pad-episode-77-remaster-part-1/ TL;DR: Somethings have changed, the ecosystem owners are definitely doing a better job of minimizing harm, but we still have a ways to go.
** Even better news for developers! **
We’re announcing our new #API Wrapper for #react
Git Repo → https://github.com/frontendnetwork/vegancheck-api-wrapper
Now on #npm:
Run → npm i @frontendnetwork/vegancheck
NPM → https://www.npmjs.com/package/@frontendnetwork/vegancheck
Julie #Gervais et Claire #Lemercier parlent des services publics et du cercle de la raison : "Le privé n’assiège pas l’État – après tout, les consultants répondent à des appels d’offres. Mais force est de constater qu’au terme de leur formation dans les grandes écoles nos très hauts fonctionnaires et nos dirigeants politiques sont convaincus de la supériorité du général sur le particulier, et font de la rentabilité financière un objectif central et universel, pour le public comme pour le privé. Cette foi préside ensuite aux règles de gestion des #servicesPublics. Les cadres qui veulent grimper dans la hiérarchie doivent aussi y adhérer."
⸺
https://www.telerama.fr/debats-reportages/deconnexion-du-terrain-injonction-au-profit-pourquoi-les-gouvernements-echouent-a-ameliorer-les-services-publics-7015430.php #LOLF #T2A #NPM #sociologie #colonialité #méritocratie #citation
npm packages are no longer signed with PGP signatures
https://github.blog/changelog/2023-05-02-npm-packages-are-no-longer-signed-with-pgp-signatures/
#ES_Next_News #ECMAScript #JavaScript #npm
Probleme de renouvellement de certificat Let's Encrypt NPM
Si vous rencontrez un souci sur la certification …
#npm #NginxProxyManager #pip #zope #lienstechsystemfr
https://liens.techsystem.fr/shaare/rI6pYQ
(Via https://liens.techsystem.fr/shaare/rI6pYQ)
Error while using create-react-app #commandline #nodejs #npm
Dependabot relieves alert fatigue from npm devDependencies #github #npm https://github.blog/2023-05-02-dependabot-relieves-alert-fatigue-from-npm-devdependencies/
Dependabot relieves alert fatigue from npm devDependencies
Check it out! 👇
https://github.blog/2023-05-02-dependabot-relieves-alert-fatigue-from-npm-devdependencies/
#SupplyChainSecurity #Npm #Dependabot #Security #Product #OpenSource
I hate #npm and node_modules with all my being
it stopped working without a reason, it compiles fine on the server, not on my machine 🤦♀️
Todo dia, muita gente pega um pacote aleatório do #NPM que aparentemente resolve um problema e começa a usar no seu projeto sem dar muito trabalho de pensamento em segurança ou auditoria. Isso é comum, e também uma das principais causas de problemas
Managed to get my #Glitch startup time down to ~5 seconds from ~15 seconds with a combination of two things:
- A webhook in the deployed app that's triggered whenever a push event happens, which force-pulls from the "glitch" branch if conditions are met
- A #GitHub workflow that trims and packages the repository then force-pushes to the "glitch" branch to eliminate the package installation step when Glitch is refreshed
@thePunderWoman I guess #NPM does use "bin" as referring to executables, which is kind of the same mistake? Though that's usually not used when referring to a build output.
I've been updating my site at https://starbreaker.org/ with #IndieWeb #microformats.
#IndieAuth for starbreaker.org works.
h-card is implemented.
https://indiewebify.me/validate-h-card/?url=https%3A%2F%2Fstarbreaker.org%2F
h-entry validation still needs a bit of work.
And I haven't gotten around to #WebMentions yet, but there's a #npm package I can run on one of my machines at home as a cron job to check my #RSS feed and send them. Receiving them will entail some more work...
Introducing npm package provenance
https://github.blog/2023-04-19-introducing-npm-package-provenance/
#ES_Next_News #ECMAScript #JavaScript #NodeJS #npm
I've officially released my first #webComponent on #npm - Formula - https://www.npmjs.com/package/@webhelpers/formula
It works with any static HTML5 form and turns into a Reactive Form, all you need to do is wrap the form in `<formula-form>` and it starts working - Demo here https://stackblitz.com/edit/vitejs-vite-skkuff?file=index.html
Increase trust in your #npm packages and improve supply chain #security with #GitHub Actions https://github.blog/2023-04-19-introducing-npm-package-provenance/
Well, this is *very* nice. Provenance statements on #npm for releases that can be traced back to specific commits + build scripts.
I'm of the habit of *always* installing NPM deps as `devDependencies` because I'm never publishing NPM packages, so all my dependencies are build-time. It's a pain when I accidently forget the -D and it creates a `dependencies` array in my package.json. #node #nodejs #javaScript #js #npm #npmrc #web #webDev #programming #developer
So I add this to my .npmrc's now:
#npm now allows to link a published package to the exact source it was built from:
https://github.blog/2023-04-19-introducing-npm-package-provenance/
"when you build your #NPM projects on GitHub Actions, you can publish Provenance alongside your package"
https://github.blog/2023-04-19-introducing-npm-package-provenance/
Say I've got a handful of #NPM packages, and they share a few common dependencies, and a list of versions for each package, so:
```
a@1.0.0
a@1.1.0
b@1.0.0
b@1.0.1
```
I need to generate the smallest number of #semver-compatible bundles of the shared dependencies.
So given a list of specific package specs, I need a function that returns a list of highest-semver-compatible dep specs
in: `[ 'a@1.0.0', 'b@2.0.0',]`
out: `['dep-a@1.2.3', 'dep-b@1.1.0']`
Is there already a tool that can do that?
“Flat node_modules is not the only way” by @zkochan
[How pnpm manages node_modules]
https://pnpm.io/blog/2020/05/27/flat-node-modules-is-not-the-only-way
#NodeJS #npm #pnpm
Also, released the #npm module just to get it available so I could build the demo - and it's already got over 150 downloads without any advertising it 🤔
If you're looking for an alternative to cross-fetch that has node.js 18+ support (for native fetch), then you might be interested in this from my former employer: https://github.com/inrupt/universal-fetch
Or:
npm install @inrupt/universal-fetch
Socket `npm` wrapper feedback update
https://socket.dev/blog/socket-npm-wrapper-feedback-update
#ES_Next_News #ECMAScript #JavaScript #npm #NodeJS
Urgh, there are a gazillion monaco-editor-vue3 packages on npm.
How should you find the right one?
Does anyone have a recommendation?
Or maybe a lighter-weight alternative to monaco?
Edit: @niklaskorz has recommended #CodeMirror, which looks great! Thank you! ❤️
Why is the user experience for #npm and #pip so awful when you have to deal with private repos?
Both tools like to make it impossible to install anything when a credential expires/repo is unreachable and you get useless error messages and have to spend hours googling/ asking 6 people before you find which config file (local? global? other?) has the ref to the private repos
https://www.hanselman.com/blog/everythings-broken-and-nobodys-upset
Okay it's been 6 years: we should probably have a long discussion on how #Prettier is the most successful #JavaScript project of the last decade
It knows exactly what it is and isn't, never breaks on me, is incredibly missed when it's not there. Unproblematic king 👑
#nodejs #js #webDev #webDevelopment #frontEnd #web #npm #node #programming
First #GitHub now #npm 😪 🤮
Are we really giving Open-Source all into one giant coorps hands?
https://github.blog/2020-03-16-npm-is-joining-github/