Recent searches
Search options
#npm
“slopsquatting, a new term for a surprisingly effective type of software supply chain attack that emerges when LLMs “hallucinate” package names that don’t actually exist. If you’ve ever seen an AI recommend a package and thought, “Wait, is that real?”—you’ve already encountered the foundation of the problem.
And now attackers are catching on.”
The Rise of Slopsquatting: How #AI Hallucinations Are Fueling... https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks #npm #dev #infosec
Edit: more info: https://www.bleepingcomputer.com/news/security/ai-hallucinated-code-dependencies-become-new-supply-chain-risk/
Package Manager for Markdown
I'm working on a project that is intended to encourage folk to make markdown text files which can be bundled together in different bundles of text files using a package manager.
Question for coders; Which package manager would you suggest I use?
Main criterias (in order) are:
1. Easy for someone with basic command line skills to edit the file and update version numbers and add additional packages.
2. All being equal, more commonly and easy to setup is preferred.
#Markdown #CommonMark #PackageManager #Programming #Dev
#NPM #RubyGems #Cargo #PickingAMastodonInstance
#Ruby #Python #Rust #Javascript #NodeJs #Lisp #CommonGuide
#Infostealer campaign compromises 10 #npm packages, targets devs
@henry Having (almost fully) switched to #NodeJS in 2012, I quickly recognized the danger of relying to _anything_ (#npm included, this one gave me a lot of pain for several times over the years).
Ended up with a monstrous monorepo. Forked (and improved) just 2 other people's repos, one abandoned and one that took months to finally get it right regarding garbage collection, but I had no time to wait.
Thereby I never got to a situation to hate a programming language because of the hype around it, but it surely got me coding a ton of #javascript.
The experience helped me a lot in JS5=>ECMAScript and ECMAScript=>TypeScript switching in the last year or so.
New #npm attack poisons local packages with backdoors
https://www.bleepingcomputer.com/news/security/new-npm-attack-poisons-local-packages-with-backdoors/
#NPM: Two malicious packages were discovered on npm (#NodeJS package manager) that covertly patch legitimate, locally installed packages to inject a persistent reverse shell backdoor:
#SoftwareSupplyChainSecurity
https://www.bleepingcomputer.com/news/security/new-npm-attack-poisons-local-packages-with-backdoors/
@BleepingComputer Do we think something like this is enough to find if this garbage is present on a Linux system? `sudo find / -iregex '.*ethers-.*`
#node #npm #malware
Out of pure curiosity, and because I'm on that #webdev #framework discovery tip. Heck, this project even made me download an IDE for Android lol
Just to read `install.bin` - which is an sh script.
Excuse me, but why are you bundling #nodejs and #npm? Is it to facilitate a setup process for containers, or is it merely to make the process easy?
I'm a bit sceptical to that sort of thing, especially when fetching from a vendors domain directly.
Any plans to build packages via CI?
Quick question for the node.js developers on the fediverse.
How would I go about monitoring an app's memory and CPU usage over time?
Week 11 of the #Privacy Roundup is out. Featuring:
- Data broker bragging about having personal information of billions of people
- How the ESP32 #Bluetooth backdoor isn't a backdoor
- North Korean government APTs spreading #malware on #Google play, #npm
- An ICE OSINT Tool that can monitor 200+ websites of a target
- #Apple patching an exploited zero-day in WebKit
- #Microsoft Patch Tuesday, 6 exploited zero-days
... and more, of course.
#NorthKorea's #Lazarus hackers infect hundreds via #npm packages
Six malicious packages have been identified on npm.The packages, which have been downloaded 330 times, are designed to steal account credentials, deploy backdoors on compromised systems, and extract sensitive cryptocurrency information.
Threat group is known for pushing malicious packages into software registries like npm which is used by millions of JavaScript developers, and compromising systems passively.
https://www.bleepingcomputer.com/news/security/north-korean-lazarus-hackers-infect-hundreds-via-npm-packages/
Lazarus Strikes npm Again With New Wave of Malicious Packages, by @SocketSecurity:
https://socket.dev/blog/lazarus-strikes-npm-again-with-a-new-wave-of-malicious-packages
Do you want to advertise "my Node.js product now uses AI!!" but don't know how to add AI?
Use the package "is-even-ai"
#Development #Launches
SQL Noir · A game to learn SQL by solving crimes https://ilo.im/162ciw
_____
#OpenSource #Game #Database #SQL #MySQL #SQLite #PostgreSQL #Npm #WebDev #Backend
Are you still using npm transpile services like esm.sh and unpkg.com?
dependency deduplication install hooks and native add-ons loading data files
Here's why we recommend importing npm packages natively via npm specifiers
https://deno.com/blog/not-using-npm-specifiers-doing-it-wrong
That thing we said would keep happening if #npm didn't add signed packages keeps happening
https://www.mend.io/blog/fake-vs-code-extension-on-npm-spreads-multi-stage-malware/
Is there a suite of vanilla JS web components implemented as classes somewhere on https://npmjs.org? Like, what if I want a Dark Mode switch or a tags input field with auto-complete that I can import (via import maps, of course), is there a project or namespace where I could find those?
Just released Node Pebble version 5.1.1
• Updated to Pebble version 2.7.0.
• Now also supports macOS and arm64 (because Pebble itself does).
https://codeberg.org/small-tech/node-pebble
Node Pebble is a Node.js wrapper for Let’s Encrypt’s¹ Pebble² that:
• Downloads the correct Pebble binary for your platform.
• Launches and manages a single Pebble process.
• Returns a reference to the same process on future calls (safe to include in multiple unit tests where order of tests is undetermined)
• Automatically patches Node.js’s TLS module to accept Pebble server’s test certificate as well as its dynamically-generated root and intermediary CA certificates.
² “A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server not suited for a production certificate authority.” https://github.com/letsencrypt/pebble