Tag npm

Reposted Tane Piper ⁂ (@tanepiper@tane.codes)

Post details

#npm is 14 years old - 8 years ago I wrote a first proof of concept of a supply chain attack, Microsoft have owned it for 4 years and have done absolutely nothing to secure it. (That supply chain attack - https://github.com/tanepiper/steal-ur-stuff)

Tue, 05 Nov 2024 19:41 by Jamie Tanna . #security #supply-chain-security #npm.

Article

Using dependency-management-data with npm's SPDX and CycloneDX SBOM export functionality (1 mins read).

How to get started with npm's SBOM export functionality with dependency-management-data.

Sun, 05 Nov 2023 20:45 by Jamie Tanna . #dependency-management-data #sbom #npm.

Liked bob (@bob@mastodon.me.uk)

Post details

Content warning: npm

Tue, 08 Aug 2023 10:46 by Jamie Tanna . #npm.

Liked https://youtube.com/watch?v=Yx6k6WR8GRs .

Mon, 07 Aug 2023 14:19 by Jamie Tanna . #music #satire #javascript #npm #nodejs.

Liked Jan Lehnardt :couchdb: (@janl@narrativ.es)

Post details

current status: `npm ruin build`

Wed, 31 May 2023 14:24 by Jamie Tanna . #npm.

Liked Introducing npm package provenance | The GitHub Blog by Brian DeHamer

Post details

How to verifiably link npm packages to their source repository and build instructions.

Thu, 20 Apr 2023 07:18 by Jamie Tanna . #security #npm.

Liked a post on Twitter

Post details

1. Buy expired NPM maintainer email domains. 2. Re-create maintainer emails 3. Take over packages 4. Submit legitimate security patches that include package.json version bumps to malicious dependency you pushed 5. Enjoy world domination.
Lance R. Vick ( @lrvick@mastodon.social ) (@lrvick)Mon, 09 May 2022 21:20 +0000

Wed, 11 May 2022 20:19 by Jamie Tanna . #security #npm.

Bookmark

Bookmarked https://thehackernews.com/2022/04/npm-bug-allowed-attackers-to-distribute.html?m=1 .

Wed, 27 Apr 2022 16:28 by Jamie Tanna . #nodejs #npm.

Liked a post on Twitter

Post details

Ever forget what npm scripts are available? Run this: npm run This produces a list of scripts, and displays the code that each script runs. Quite handy.
Cory House (@housecor)Tue, 05 Apr 2022 16:07 +0000

Thu, 07 Apr 2022 15:45 by Jamie Tanna . #npm.

Liked https://blog.izs.me/2021/10/my-favorite-npm-commit/ .

Mon, 21 Mar 2022 10:06 by Jamie Tanna . #npm.

Liked a post on Twitter

Post details

Running npm scripts on install should require opt-in from both 'npm install' and from indicating that you expect an upstream dependency to run scripts in the first place, e.g. "dependencies": { "foo": "1.2.3:with_scripts" }
Ryan Cavanaugh (@SeaRyanC)Thu, 17 Mar 2022 23:18 GMT

Fri, 18 Mar 2022 11:52 by Jamie Tanna . #npm.

Liked https://therecord.media/thousands-of-npm-accounts-use-email-addresses-with-expired-domains/ .

Sat, 12 Feb 2022 11:58 by Jamie Tanna . #security #npm.

Liked a post on Twitter

Post details

I'VE LITERALLY BEEN SAYING FOR YEARS NPM IS BAD AND NPM IS AN ATTACK VECTOR AND NPX IS WORSE. (I even built a proof of concept to steal shit) Was told "that's how it works 🤷‍♂️) github.com/npm/npm/issues…
Post details
Open source developer corrupts widely-used libraries, affecting tons of projects theverge.com/2022/1/9/22874…
The Verge (@verge)Sun, 09 Jan 2022 20:58 GMT
Tane Piper (@tanepiper)Mon, 10 Jan 2022 07:01 GMT

Mon, 10 Jan 2022 07:44 by Jamie Tanna . #npm.

Liked https://sergiodxa.com/articles/github-actions-npm-publish .

Fri, 07 Jan 2022 14:18 by Jamie Tanna . #github #npm #nodejs.

Liked https://michaelzanggl.com/articles/github-actions-cd-setup/ .

Fri, 07 Jan 2022 14:17 by Jamie Tanna . #github #npm #nodejs.

Liked https://snyk.io/blog/github-actions-to-securely-publish-npm-packages/ .

Fri, 07 Jan 2022 14:12 by Jamie Tanna . #github #npm #node.

Liked a post on Twitter

Post details

Just use an npm package.
Den Delimarsky (@DennisCode)Sun, 26 Dec 2021 05:17 GMT

Mon, 27 Dec 2021 14:09 by Jamie Tanna . #security #open-source #nodejs #npm.

Liked https://drewdevault.com/2021/11/16/Cash-for-leftpad.html .

Tue, 16 Nov 2021 15:54 by Jamie Tanna . #shitpost #npm.

Bookmark

Bookmarked https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/ .

Tue, 16 Nov 2021 09:09 by Jamie Tanna . #security #github #npm.

Liked https://btao.org/2021/09/09/npm-install-is-curl-bash/ .

Sun, 07 Nov 2021 09:40 by Jamie Tanna . #nodejs #npm #security #package-management.

Liked a post on Twitter

Post details

Developing web apps with Node (h/t bit.ly/nodecat)
Addy Osmani (@addyosmani)Thu, 12 Nov 2020 09:00 GMT

Thu, 12 Nov 2020 12:33 by Jamie Tanna . #nodejs #npm.

Liked a post on Twitter

Post details

https://twitter.com/isntitvacant/status/1305239611614965760
When you say that you "walked into a dumpster fire to save the web" you might want to clarify what _kind_ of dumpster fire: you knowingly joined a company that just wrapped up union busting
Chris Dickinson (@isntitvacant)Sun, 13 Sep 2020 20:29 +0000

Mon, 14 Sep 2020 08:46 by Jamie Tanna . #npm.

Liked a post on Twitter

Post details

I hate how reminders of the late management at NPM can still send me into a stress/anger spiral. I hate that they go on popular podcasts and disparage the good work of the team that came before them, while simultaneously taking credit for things they didn't actually do.
Chris Dickinson (@isntitvacant)Sun, 13 Sep 2020 20:18 +0000

Mon, 14 Sep 2020 08:46 by Jamie Tanna . #npm.

Liked a post on Twitter

Post details

Every time I npm install 😅
Post details
does your macbook sound like this too? 😅🔊
Kap 💃 (@kapehe_ok)Wed, 10 Jun 2020 17:06 +0000
Carol 😅 (@CarolSaysThings)Thu, 11 Jun 2020 09:58 +0000

Thu, 11 Jun 2020 21:44 by Jamie Tanna . #npm.

#npm allows you to do things like this, with other people's code (in a good way):

You Made This? I made this

Wed, 15 Jan 2020 08:31 by Jamie Tanna . #npm.

Bookmark

Bookmarked https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli .

Fri, 13 Dec 2019 17:43 by Jamie Tanna . #npm #nodejs #javascript #security.

You're currently viewing page 1 of 1, of 26 posts.