Fosstodon

Jonathan MatthewsAnyone else seeing <a href="https://fosstodon.org/tags/npm" class="mention hashtag" rel="tag">#npm</a> package installation failures? I can see <a href="https://status.npmjs.org/incidents/hdtkrsqp134s" target="_blank" rel="nofollow noopener noreferrer" translate="no">https://status.npmjs.org/incidents/hdtkrsqp134s</a>, but the "scoped to certain keywords" is both weasel-wording and confusing ... <a href="https://fosstodon.org/tags/npmjs" class="mention hashtag" rel="tag">#npmjs</a> <a href="https://fosstodon.org/tags/javascript" class="mention hashtag" rel="tag">#javascript</a> <a href="https://fosstodon.org/tags/devops" class="mention hashtag" rel="tag">#devops</a>

Nate Silva<a href="https://noc.social/@cloudflare" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@cloudflare</a> Cloudflare, are you blocking anything with the word “camel” in it? Such as NPM modules that have `camelcase` in the name?<a href="https://hachyderm.io/tags/outage" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#outage</a> <a href="https://hachyderm.io/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://hachyderm.io/tags/cloudflare" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cloudflare</a> <a href="https://hachyderm.io/tags/camel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#camel</a>

HaraldLooking for a simple way to provide a compressed archive from a web application with the requirement to create the archive in the browser, not on the server.- JSZip: 12 (transitive) dependencies - tar-js: 0 dependenciesWhile zip may be more common, the 0-dependencies is a unique selling point for me!<a href="https://nrw.social/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://nrw.social/tags/zip" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#zip</a> <a href="https://nrw.social/tags/tar" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tar</a> <a href="https://nrw.social/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#programming</a> <a href="https://nrw.social/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a>

postmodernHow many vanilla.js/zero-dependency reusable components are there on <a href="https://npmjs.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://npmjs.com</a>? I can easily write my own components for simple things, like a Dark Mode switch, as plain old JavaScript classes that directly manipulate the DOM. Why can't I simply add a bunch of these components to my project and use import-maps to load them?<a href="https://ruby.social/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://ruby.social/tags/vanillajs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#vanillajs</a> <a href="https://ruby.social/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a>

gemma lynni just explained that i don't want to pull in a dependency from <a href="https://void.ello.tech/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> because george washington taught me to avoid entangling alliances, how's your monday goin

Chris Burgesshmm, i know it's early but is npmjs showing 404s for a lot of packages right now? seems soevery "popular library" on <a href="https://www.npmjs.com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.npmjs.com/</a> is a 404 if clicked<a href="https://toot.cafe/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://toot.cafe/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a>

PhylumIn the last 6 months, roughly 70% of new <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> packages were <a href="https://infosec.exchange/tags/spam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#spam</a>. What does this mean for supply chain security? At Black Hat USA? Find us in Startup City booth SC203!<a href="https://infosec.exchange/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://infosec.exchange/tags/node" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#node</a> <a href="https://infosec.exchange/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://infosec.exchange/tags/typescript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#typescript</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a><a href="https://blog.phylum.io/the-great-npm-garbage-patch" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.phylum.io/the-great-npm-garbage-patch</a>

PhylumWe've uncovered <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> hidden in a Microsoft logo JPG, shipping as fake <a href="https://infosec.exchange/tags/AWS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AWS</a> packages on <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a>! 😲 <a href="https://blog.phylum.io/fake-aws-packages-ship-command-and-control-malware-in-jpeg-files/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.phylum.io/fake-aws-packages-ship-command-and-control-malware-in-jpeg-files/</a><a href="https://infosec.exchange/tags/steganography" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#steganography</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://infosec.exchange/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://infosec.exchange/tags/typescript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#typescript</a> <a href="https://infosec.exchange/tags/software" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#software</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/js" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#js</a>

PhylumAdvanced threat actors have not let up on their attacks against the software supply chain. We catalog recent attacks from North Korean state actors in our new blog post!<a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://infosec.exchange/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://infosec.exchange/tags/typescript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#typescript</a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a><a href="https://blog.phylum.io/new-tactics-from-a-familiar-threat/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.phylum.io/new-tactics-from-a-familiar-threat/</a>

PhylumSupply chain attacks come in all shapes and sizes. Today Phylum Research discusses its discovery of malicious <a href="https://infosec.exchange/tags/jQuery" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#jQuery</a> files in <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a>.<a href="https://blog.phylum.io/persistent-npm-campaign-shipping-trojanized-jquery/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.phylum.io/persistent-npm-campaign-shipping-trojanized-jquery/</a><a href="https://infosec.exchange/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/sbom" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sbom</a> <a href="https://infosec.exchange/tags/js" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#js</a> <a href="https://infosec.exchange/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://infosec.exchange/tags/node" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#node</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/softwaredevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#softwaredevelopment</a> <a href="https://infosec.exchange/tags/software" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#software</a>

barefootstache<a href="https://qoto.org/tags/DailyBloggingChallenge" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DailyBloggingChallenge</a> (320/365)Implementing ICS was quite easy after finding a functional library on <a href="https://qoto.org/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a>.The difficulty was creating a parsing function that takes the already existing data format and put it into the <a href="https://qoto.org/tags/ical" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ical</a> one. This means the new property <code>duration</code> was introduced using the same schema as provided from the ics library.

PhylumCredential stealer? ✅ Keylogger? ✅ Cryptocurrency stealer? ✅Phylum uncovers more malicious <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> packages targeting the <a href="https://infosec.exchange/tags/Javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Javascript</a> ecosystem.<a href="https://blog.phylum.io/npm-package-caught-exfiltrating-crypto" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.phylum.io/npm-package-caught-exfiltrating-crypto</a><a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/bitcoin" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bitcoin</a> <a href="https://infosec.exchange/tags/cryptocurrency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptocurrency</a> <a href="https://infosec.exchange/tags/typescript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#typescript</a> <a href="https://infosec.exchange/tags/software" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#software</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a> <a href="https://infosec.exchange/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a>

Mathias PanzenböckThe search bar of <a href="https://npmjs.com" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://npmjs.com</a> is annoyingly broken. You have to press enter twice for it to actually search. It always takes me a moment to remember and I wonder why it's taking so long to load the search results. <a href="https://chaos.social/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://chaos.social/tags/wtf" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#wtf</a>

PhylumWe've uncovered new <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> packages published to <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> that appear to be an evolution on a previous supply chain attack carried out by nation state backed actors ☠<a href="https://blog.phylum.io/north-korean-state-actors" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://blog.phylum.io/north-korean-state-actors</a><a href="https://infosec.exchange/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://infosec.exchange/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://infosec.exchange/tags/supplychainattack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#supplychainattack</a> <a href="https://infosec.exchange/tags/opensource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#opensource</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://infosec.exchange/tags/reverseengineering" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#reverseengineering</a> <a href="https://infosec.exchange/tags/typescript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#typescript</a>

Steven HiltonIt's been ... a while ... since I tried to log into <a href="https://mastodon.online/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a>.org. So long that now <a href="https://mastodon.online/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2fa</a> is required. I don't have an "authenticator" with them and I don't have my "recovery codes". Now I can't login at all. I can't contact them on the support page because I have to "sign in for assistance".My email history says I enabled it 2 years ago. But my phone from that time is gone. Have I permanently lost the account? Do I have any other recourse? <a href="https://mastodon.online/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://mastodon.online/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

Curtis Parfitt-FordFor reasons I can't yet fathom, <a href="https://social.mashed.cloud/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> has specifically blocked me at a WAF level from accessing yarn.npmjs.org. I've not been doing anything other than normal yarn installs, so this is super confusing, and reaching out to npm support has so far been fruitless - with them asking for an npm debug log :(Does anyone know anyone at <a href="https://social.mashed.cloud/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> or <a href="https://social.mashed.cloud/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a> who might be able to help resolve this? :boostRequest:

Emelia 👸🏻I wish we could document maintainers for npm packages without those people having direct publish access (i.e., forcing publishes to go through CI/CD)<a href="https://hachyderm.io/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://hachyderm.io/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a>

data0<a href="https://indieweb.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> had 2.5 million live packages by the end of 2023, downloaded 184+ billion times per month. 5k <a href="https://indieweb.social/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> and 15k <a href="https://indieweb.social/tags/spam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#spam</a> packages were found last year. There's a package named 214x the letter "a". There's one almost 6 GB in size!Remember to always use as less <a href="https://indieweb.social/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> dependencies as possible, carefully vet what you're using and to run it in a container (also during dev).<a href="https://socket.dev/blog/2023-npm-retrospective" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://socket.dev/blog/2023-npm-retrospective</a>

Lorenzo 'kelset' Sciandra24: <a href="https://mastodon.online/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> (Node Package Manager) - "The world's largest software registry for JavaScript."

eklemWhat's the deal with all the nolb - No one left behind-packages people publish on NPM and similar libraries at GitHub?<a href="https://social.vivaldi.net/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://social.vivaldi.net/tags/NPMJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPMJS</a> <a href="https://social.vivaldi.net/tags/Node" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Node</a> <a href="https://social.vivaldi.net/tags/NodeJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NodeJS</a> <a href="https://social.vivaldi.net/tags/GitHub" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GitHub</a> <a href="https://social.vivaldi.net/tags/NOLB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NOLB</a>

Recent searches

Search options

Administered by:

Server stats:

#npmjs