The massive bug at the heart of the npm ecosystem
Disclosure: I was the Staff Engineering Manager for the npm CLI team between July 2019 & December 2022. I was a part of the GitHub acquistion of npm inc. in 2020. I left GitHub, for various reasons, in December. tldr;a npm package's manifest is published independently from its tarballmanifests are never fully validated against the tarball's contentsthe ecosystem has broadly assumed the contents of
ni.zsh: npmインストール時のサプライチェーン攻撃を検知する機能を追加
npm/yarn/pnpm/bunを同じコマンドで扱えるni.zshに、npmで配布されているマルウェアを間違ってインストールするのを防ぐ機能を追加しました。 ni.zshについては、次の記事を参照してください。 npm/yarn/pnpm/bunを同じコマンドで扱える ni のzsh実装を書いた | Web Scratch npmパッケージのマルウェア npmパッケージとしてマルウェアをpublishして開発者を狙うサプライチェーン攻撃が最近多くなっています。 たとえば、次の記事ではemails-helperというもっともらしいパッケージ名でマルウェアが配布されていました。 NPM Package Masquerading as Email Validator Contains C2 and Sophisticated Data Exfiltration 他にもtyposquatting
Improvements to granular access tokens on npm
July 11, 2023 Today we are making further improvements to granular access tokens in npm. Highlights of this update are Custom Expiration Times: You can now create granular access tokens with custom expiration times, allowing for durations that span multiple years. Increased Token Limit: We have expanded the maximum limit for granular access tokens creation to 1000. This enables maintainers with a
Introducing npm package provenance
Open SourceSecurityIntroducing npm package provenanceHow to verifiably link npm packages to their source repository and build instructions. Starting today, when you build your npm projects on GitHub Actions, you can publish provenance alongside your package by including the --provenance flag. This provenance data gives consumers a verifiable way to link a package back to its source repository and
Google Slides: Sign-in
Not your computer? Use a private browsing window to sign in. Learn more
npm Best Practices for the Supply-Chain – Open Source Security Foundation
By Myles Borins (GitHub), Jordan Harband (No affiliation), Jeff Mendoza (Google), Erez Rokah (CloudQuery), Laurent Simon (Google), Liran Tal (Snyk), Randall T. Vasquez (Gentoo) We are excited to announce the v1 release of the “npm Best Practices,” a new guide focused on dependency management and supply chain security for npm. This release is the result of the OpenSSF Best Practices Working Group.
Introducing the new npm Dependency Selector Syntax
August 3, 2022 npm query is a new top-level command as of npm v8.16.0 which accepts a Dependency Selector (as defined in the Dependency Selector Syntax Specification) & returns a filtered JSON Array/NodeList of dependencies from your project. We believe this capability has been a missing piece of the package management ecosystem; With its introduction we hope to unlock the potential for developers
Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine | Snyk
On March 15, 2022, users of the popular Vue.js frontend JavaScript framework started experiencing what can only be described as a supply chain attack impacting the npm ecosystem. This was the result of the nested dependencies node-ipc and peacenotwar being sabotaged as an act of protest by the maintainer of the node-ipc package. This security incident involves destructive acts of corrupting files
node-ipcに悪意あるコードが含まれている問題について
node-ipcというnpmパッケージに悪意あるコードが含まれていた問題についてのメモ書きです。 2022-03-15に、node-ipcのメンテナーによって悪意あるコードを含むnode-ipcが公開されていた問題です。 問題のあるバージョン 9.2.2 unpublish済み Hidden functionality in node-ipc · GHSA-8gr3-2gjw-jj7g · GitHub Advisory Database 10.1.1, 10.1.2 unpublish済み Embedded Malicious Code in node-ipc · CVE-2022-23812 · GitHub Advisory Database 11.0.0+ node-ipc behavior change · GHSA-3mpp-xfvh-qh37 · GitHub Advisor
[RRFC] Change the default save-prefix from ^ to none · Issue #509 · npm/rfcs
(Ported from npm/cli#4227) TLDR This PR changes the default behaviour of NPM to not save package versions with the ^ prefix. Instead, packages would be saved with no prefix. As a TL;DR, the implications of this is that all dependencies will be pinned to the version you installed by default. Changing This Yourself If you're reading this PR and want to apply it to your own environments, invoke npm c
![[RRFC] Change the default save-prefix from ^ to none · Issue #509 · npm/rfcs](https://cdn-ak-scissors.b.st-hatena.com/image/square/7151739049775dd451b336b47ac31ef71aeca3b0/height=288;version=1;width=512/https%3A%2F%2Fopengraph.githubassets.com%2F4ef62f29af41028e3b0eae1c0bbfa2049f77b18bf3d69a6443b58332590f9f95%2Fnpm%2Frfcs%2Fissues%2F509)
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
[Feature] Add support for `yarn npm publish --provenance` and `publishConfig.provenance` option · Issue #5430 · yarnpkg/berry
Threat analysis: Malicious npm package mimics Material Tailwind CSS tool
package-manager-best-practices/published/npm.md at main · ossf/package-manager-best-practices
Better anti-war message for Russians by limonte · Pull Request #2462 · sweetalert2/sweetalert2
Snyk Vulnerability Database | Snyk
Socket - Secure your dependencies. Ship with confidence.
Report: 1,300 malicious npm packages detected recently - SD Times
huntr - The world’s first bug bounty platform for AI/ML
(Semi-Official) Status Update · Issue #317 · Marak/colors.js
Zalgo issue with `v1.4.44-liberty-2` release · Issue #285 · Marak/colors.js
