Secure JavaScript URL validation | Snyk
This post, originally published on October 18, 2022, has been updated to show how Snyk can help you establish secure JavaScript URL validation. When developers need to handle URLs in different forms for different purposes — such as browser history navigation, anchored targets, query parameters, and so on — we often turn to JavaScript. However, its frequent use motivates attackers to exploit its vu
Choosing the best Node.js Docker image | Snyk
Updated recommended Node.js version, examples and vulnerability scan results to reflect the up-to-date Node.js LTS releases Choosing a Node.js Docker image may seem like a small thing, but image sizes and potential vulnerabilities can have dramatic effects on your CI/CD pipeline and security posture. So, how do you choose the best Node.js Docker image? It can be easy to miss the potential risks of
10 best practices to containerize Node.js web applications with Docker | Snyk Blog | Snyk
September 14, 2022: Check out our new and improved cheat sheet for containerizing Node.js web applications with Docker! Are you looking for best practices on how to build Node.js Docker images for your web applications? Then you’ve come to the right place! The following article provides production-grade guidelines for building optimized and secure Node.js Docker images. You’ll find it helpful rega
Best practices for creating a modern npm package with security in mind | Snyk
Technology is always changing and your processes and practices need to keep up with those changes. So while npm is 12 years old, your practices around npm package creation should hopefully be a lot more modern. If you have a feeling they may be a little out of date, though, keep reading. In this tutorial, we’re going to walk step by step through creating an npm package using modern best practices
Vulnerable Visual Studio Code extensions impact over 2M Developers | Snyk
We have been witnessing an ever growing amount of supply chain security incidents in the wild. Everything from open source package managers security flaws being exploited to continuous integration systems being compromised to software artifacts being backdoored. And now, those incidents are starting to extend to the place where developers spend most of their time: their integrated development envi
Understanding filesystem takeover vulnerabilities in npm JavaScript package manager | Snyk
On the 11th of December, 2019 a security vulnerability which extends to all major JavaScript package managers (npm, yarn and pnpm) was publicly disclosed. This vulnerability, discovered by security researcher Daniel Ruf, allows malicious actors to apply varied tactics of arbitrary file overwrites. In this article: How do Node.js command line packages work? How does this security vulnerability affe
JavaScript frameworks security report 2019 | Snyk
Welcome to Snyk's State of JavaScript frameworks security report 2019. In this report, we investigate the state of security for both the Angular and React ecosystems. This report by no means intends to venture into any rivalries that may exist between the two in terms of whether one or the other is a true framework - we are not comparing them as competitive frameworks at all. Instead, we review th
10 Docker Security Best Practices | Docker Best Practices | Snyk
Docker container securityThe topic of Docker container security raises concerns ranging from Dockerfile security—relating to the Docker base images and potential security misconfigurations,—to the Docker container security at runtime regarding network ports, user privileges, Docker mounted filesystem access, and others. In this article, we will focus on the Docker container security aspects relate
Snyk research team discovers severe prototype pollution security vulnerabilities affecting all versions of lodash | Snyk
On July 2nd, 2019, Snyk published a high severity prototype pollution security vulnerability (CVE-2019-10744) affecting all versions of lodash, as the result of an on-going analysis lead by the Snyk security research team. UPDATE: lodash published version 4.17.12 on July 9th which includes Snyk fixes and remediates the vulnerability. We strongly recommend you update to the latest version of lodash
What is package lock json? Lockfiles for yarn & npm packages | Snyk
What is package-lock.json?In this article, we will discuss both npm's package lock file `package-lock.json` as well as Yarn's `_yarn.lock`. Package lock files serve as a rich manifest of dependencies for projects that specify the exact version of dependencies to be installed, as well as the dependencies of those dependencies, and so on — to encompass the full dependency tree. A package lock file i
Malicious remote code execution backdoor discovered in the popular bootstrap-sass Ruby gem | Snyk
On March 26, 2019, a malicious version of the popular bootstrap-sass package, that has been downloaded a total of 28 million times to date, was published to the official RubyGems repository. Version 3.2.0.3 includes a stealthy backdoor that gives attackers remote command execution on server-side Rails applications. We have already added the vulnerability to our database, and if your project is bei
Introducing experimental integrity policies to Node.js | Snyk
A recent experimental feature for introducing integrity policies landed in Node.js core 11.8.0. This capability, shipped in non LTS version yet, provides integrity checks for a Node.js runtime when modules are being loaded, in order to verify that the modules code haven’t been tampered with. Bradley Farias introduced this change in October 2018 and borrowed the idea from a similar security feature
10 npm Security Best Practices | Snyk
Concerned about npm vulnerabilities? It is important to take npm security best practices into account for both frontend, and backend developers. Open source security auditing is a crucial part of shifting security to the left, and npm package security should be a top concern, as we see that even the official npm command line tool has been found to be vulnerable. In this cheat sheet edition, we're
Malicious code found in npm package event-stream downloaded 8 million times in the past 2.5 months | Snyk
A widely used npm package, event-stream, has been found to contain a malicious package named flatmap-stream. This was disclosed via a GitHub issue raised against the source repo. The event-stream package makes creating and working with streams easy, and is very popular, getting roughly 2 million downloads a week. The malicious child package has been downloaded nearly 8 million times since its incl
Using Node.js event loop for timing attacks | Snyk
A little over 3 years ago, a few friends and I started a group called pasten to participate in the Chaos Computer Club’s Capture The Flag (CTF) competition. It is a jeopardy style CTF, where the participating teams need to solve security related challenges in various categories such as exploitation, reverse engineering, web, forensic & crypto. CTF is fun and educational, and I definitely recommend
Fixing `marked` XSS vulnerability | Snyk
A few weeks ago we added to our DB a Cross-Site Scripting (XSS) vulnerability in the popular marked package. This post explains the vulnerability, shows how to exploit it on a sample app, and explains how to fix the issue in your application. marked parses Markdown and converts it into HTML, making it easy to turn rendered user input - user comments, product reviews, support calls - into rich(ish)
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
Managing Node.js Docker images in GitHub Packages using GitHub Actions | Snyk
Secure Coding with IDE Plugins | IDE Security Plugins | Snyk
npm passes the 1 millionth package milestone! What can we learn? | Snyk
Severe security vulnerability in Bower’s zip archive extraction | Snyk