#npmjs — Public Fediverse posts

I just want to say FUCK YOU NPMJS.COM for making me having to create a new access token every 90 days maximum, and for offering a shitty 2FA without TOTP option

#npm #developer #webdeveloper #node #npmpackage #javascript #nodejs #node #OpenSource #FreeSoftware #js #typescrypt #web #programmer #npmjs

I just want to say FUCK YOU NPMJS.COM for making me having to create a new access token every 90 days maximum, and for offering a shitty 2FA without TOTP option

#npm #developer #webdeveloper #node #npmpackage #javascript #nodejs #node #OpenSource #FreeSoftware #js #typescrypt #web #programmer #npmjs

I just want to say FUCK YOU NPMJS.COM for making me having to create a new access token every 90 days maximum, and for offering a shitty 2FA without TOTP option

#npm #developer #webdeveloper #node #npmpackage #javascript #nodejs #node #OpenSource #FreeSoftware #js #typescrypt #web #programmer #npmjs

I just want to say FUCK YOU NPMJS.COM for making me having to create a new access token every 90 days maximum, and for offering a shitty 2FA without TOTP option

#npm #developer #webdeveloper #node #npmpackage #javascript #nodejs #node #OpenSource #FreeSoftware #js #typescrypt #web #programmer #npmjs

I just want to say FUCK YOU NPMJS.COM for making me having to create a new access token every 90 days maximum, and for offering a shitty 2FA without TOTP option

#npm #developer #webdeveloper #node #npmpackage #javascript #nodejs #node #OpenSource #FreeSoftware #js #typescrypt #web #programmer #npmjs

«Passwortsafe Bitwarden — Kommandozeilen-Client trojanisiert:
Das Bitwarden-Security-Team bestätigt, dass kurzzeitig eine bösartige Version des Kommandozeilen-Client ausgeliefert wurde.»

Jetzt war @bitwarden daran und das per NPM. Wieviel mal wird dies und ähnliches noch auftauchen? NPM ist leider mittlerweile das Einfallstor für viele Sicherheitslücken.

🔐 https://www.heise.de/news/Passwortsafe-Bitwarden-Kommandozeilen-Client-trojanisiert-11270435.html

#npm #bitwarden #javascript #hacking #passwort #js #npmjs #itsicherheit #it #web #webdev #sicherheit

«Passwortsafe Bitwarden — Kommandozeilen-Client trojanisiert:
Das Bitwarden-Security-Team bestätigt, dass kurzzeitig eine bösartige Version des Kommandozeilen-Client ausgeliefert wurde.»

Jetzt war @bitwarden daran und das per NPM. Wieviel mal wird dies und ähnliches noch auftauchen? NPM ist leider mittlerweile das Einfallstor für viele Sicherheitslücken.

🔐 https://www.heise.de/news/Passwortsafe-Bitwarden-Kommandozeilen-Client-trojanisiert-11270435.html

#npm #bitwarden #javascript #hacking #passwort #js #npmjs #itsicherheit #it #web #webdev #sicherheit

«Passwortsafe Bitwarden — Kommandozeilen-Client trojanisiert:
Das Bitwarden-Security-Team bestätigt, dass kurzzeitig eine bösartige Version des Kommandozeilen-Client ausgeliefert wurde.»

Jetzt war @bitwarden daran und das per NPM. Wieviel mal wird dies und ähnliches noch auftauchen? NPM ist leider mittlerweile das Einfallstor für viele Sicherheitslücken.

🔐 https://www.heise.de/news/Passwortsafe-Bitwarden-Kommandozeilen-Client-trojanisiert-11270435.html

#npm #bitwarden #javascript #hacking #passwort #js #npmjs #itsicherheit #it #web #webdev #sicherheit

«Passwortsafe Bitwarden — Kommandozeilen-Client trojanisiert:
Das Bitwarden-Security-Team bestätigt, dass kurzzeitig eine bösartige Version des Kommandozeilen-Client ausgeliefert wurde.»

Jetzt war @bitwarden daran und das per NPM. Wieviel mal wird dies und ähnliches noch auftauchen? NPM ist leider mittlerweile das Einfallstor für viele Sicherheitslücken.

🔐 https://www.heise.de/news/Passwortsafe-Bitwarden-Kommandozeilen-Client-trojanisiert-11270435.html

#npm #bitwarden #javascript #hacking #passwort #js #npmjs #itsicherheit #it #web #webdev #sicherheit

«Passwortsafe Bitwarden — Kommandozeilen-Client trojanisiert:
Das Bitwarden-Security-Team bestätigt, dass kurzzeitig eine bösartige Version des Kommandozeilen-Client ausgeliefert wurde.»

Jetzt war @bitwarden daran und das per NPM. Wieviel mal wird dies und ähnliches noch auftauchen? NPM ist leider mittlerweile das Einfallstor für viele Sicherheitslücken.

🔐 https://www.heise.de/news/Passwortsafe-Bitwarden-Kommandozeilen-Client-trojanisiert-11270435.html

#npm #bitwarden #javascript #hacking #passwort #js #npmjs #itsicherheit #it #web #webdev #sicherheit

I'm having issues with build tooling, so needing to do slash and burn dev development.

Have #MSFT deployed a rate limitor on #NPMJS? I have only deployed ~ 400 packages *today* to a single IP, so i should be inside reasonable usage.
My package-lock say packages are installed, but the files aren't present.

I would be downloading less packages if I have a way to remove dev-dep without `rm-rf`

I'm having issues with build tooling, so needing to do slash and burn dev development.

Have #MSFT deployed a rate limitor on #NPMJS? I have only deployed ~ 400 packages *today* to a single IP, so i should be inside reasonable usage.
My package-lock say packages are installed, but the files aren't present.

I would be downloading less packages if I have a way to remove dev-dep without `rm-rf`

🔍 Sharing a quick win from our M365 environment.

When the axios npm supply chain attack dropped (March 31, 2026), I needed a fast way to scan our Intune-managed Windows fleet for the IOC — without E3/E5.

One script, deployed in minutes:
✅ Success = clean
❌ Failed = wt.exe found in %ProgramData%

🔗 https://github.com/Bluewal/m365-intune-scripts/blob/main/defender/threat-response/Invoke-NpmAxiosScan.ps1

First post on my new toolkit repo, more scripts coming

#infosec #Intune #Microsoft365 #BlueTeam #PowerShell #npmjs

Just published: Version 2.0.0 of my #SFSymbols #React #icon package. Available on #GitHub [1] and #npmJS [2].

#Apple #Icons #IconPack

https://sfsymbolslib.layered.work

[1] https://github.com/phranck/sf-symbols-lib
[2] https://www.npmjs.com/package/sf-symbols-lib

npmjs.com anyone? Slow as hell. Same for stackoverflow sites.❓

#npmjs #stackoverflow #internetSlow

Do you need #SFSymbols in your Web project? I made a thing for that [1]. 😃

And I just published it on #npmjs [2].

#WebDevelopment #React #TypeScript

[1] https://sfsymbolslib.layered.work
[2] https://www.npmjs.com/package/sf-symbols-lib

> New TOTP (Time-based One-Time Password) setups for npm access will be permanently disabled. Existing TOTP configurations will continue to work for now, but they will be phased out in the coming months.

no, i zaraz tylko zintegrują webauthn z dowodami cyfrowymi i nie będzie można publikować pakietów w npmjs bez potwierdzenia tożsamości.

Przegapiłem też że #npmjs to teraz gith..., eee, micro$oft

https://github.blog/changelog/2025-09-29-strengthening-npm-security-important-changes-to-authentication-and-token-management/

#javascript #programowanie

Nobody should be using npmjs without checking also this:

https://npm.anvaka.com/#/view/2d/decompress-tarbz2

And btw, how stupid is it that npmjs allows to sort by dependents but not by the number of transitive dependencies. And why don't they show transitive dependencies anyway? It would make it blatantly obvious what an abyss many packages are.

#npm #npmjs #javascript #webdev

#javascript #npm #npmjs #malware

@cloudflare Cloudflare, are you blocking anything with the word “camel” in it? Such as NPM modules that have `camelcase` in the name?

#outage #npmjs #cloudflare #camel

Looking for a simple way to provide a compressed archive from a web application with the requirement to create the archive in the browser, not on the server.

- JSZip: 12 (transitive) dependencies
- tar-js: 0 dependencies

While zip may be more common, the 0-dependencies is a unique selling point for me!

#javascript #zip #tar #programming #npmjs

How many vanilla.js/zero-dependency reusable components are there on https://npmjs.com? I can easily write my own components for simple things, like a Dark Mode switch, as plain old JavaScript classes that directly manipulate the DOM. Why can't I simply add a bunch of these components to my project and use import-maps to load them?

#npmjs #vanillajs #javascript

i just explained that i don't want to pull in a dependency from #npmjs because george washington taught me to avoid entangling alliances, how's your monday goin

hmm, i know it's early but is npmjs showing 404s for a lot of packages right now? seems so

every "popular library" on https://www.npmjs.com/ is a 404 if clicked

#npmjs #npm

In the last 6 months, roughly 70% of new #npm packages were #spam. What does this mean for supply chain security?

At Black Hat USA? Find us in Startup City booth SC203!

#npmjs #node #javascript #typescript #infosec #opensource

https://blog.phylum.io/the-great-npm-garbage-patch

We've uncovered #malware hidden in a Microsoft logo JPG, shipping as fake #AWS packages on #npm! 😲

https://blog.phylum.io/fake-aws-packages-ship-command-and-control-malware-in-jpeg-files/

#steganography #opensource #cybersecurity #npmjs #javascript #typescript #software #infosec #js

Advanced threat actors have not let up on their attacks against the software supply chain. We catalog recent attacks from North Korean state actors in our new blog post!

#npm #javascript #typescript #malware #cybersecurity #npmjs

https://blog.phylum.io/new-tactics-from-a-familiar-threat/

Supply chain attacks come in all shapes and sizes. Today Phylum Research discusses its discovery of malicious #jQuery files in #npm.

https://blog.phylum.io/persistent-npm-campaign-shipping-trojanized-jquery/

#javascript #opensource #sbom #js #npmjs #node #cybersecurity #softwaredevelopment #software

#DailyBloggingChallenge (320/365)

Implementing ICS was quite easy after finding a functional library on #npmjs.

The difficulty was creating a parsing function that takes the already existing data format and put it into the #ical one. This means the new property duration was introduced using the same schema as provided from the ics library.

Credential stealer? ✅ Keylogger? ✅ Cryptocurrency stealer? ✅

Phylum uncovers more malicious #npm packages targeting the #Javascript ecosystem.

https://blog.phylum.io/npm-package-caught-exfiltrating-crypto

#malware #opensource #bitcoin #cryptocurrency #typescript #software #infosec #cybersecurity #npmjs

We've uncovered new #malware packages published to #npm that appear to be an evolution on a previous supply chain attack carried out by nation state backed actors ☠

https://blog.phylum.io/north-korean-state-actors

#npmjs #javascript #supplychainattack #opensource #infosec #reverseengineering #typescript

It's been ... a while ... since I tried to log into #npmjs.org. So long that now #2fa is required. I don't have an "authenticator" with them and I don't have my "recovery codes". Now I can't login at all. I can't contact them on the support page because I have to "sign in for assistance".

My email history says I enabled it 2 years ago. But my phone from that time is gone.

Have I permanently lost the account? Do I have any other recourse? #javascript #security

For reasons I can't yet fathom, #npm has specifically blocked me at a WAF level from accessing yarn.npmjs.org. I've not been doing anything other than normal yarn installs, so this is super confusing, and reaching out to npm support has so far been fruitless - with them asking for an npm debug log :(

Does anyone know anyone at #npmjs or #GitHub who might be able to help resolve this? :boostRequest:​

I wish we could document maintainers for npm packages without those people having direct publish access (i.e., forcing publishes to go through CI/CD)

#npm #npmjs

#npm had 2.5 million live packages by the end of 2023, downloaded 184+ billion times per month. 5k #malware and 15k #spam packages were found last year. There's a package named 214x the letter "a". There's one almost 6 GB in size!

Remember to always use as less #npmjs dependencies as possible, carefully vet what you're using and to run it in a container (also during dev).

https://socket.dev/blog/2023-npm-retrospective

24: #npmjs (Node Package Manager) - "The world's largest software registry for JavaScript."

What's the deal with all the nolb - No one left behind-packages people publish on NPM and similar libraries at GitHub?

#NPM #NPMJS #Node #NodeJS #GitHub #NOLB

Guys!
If you want to make a #crossplatform #app, and you don't know what's framework should I use?
Just use #Tauri and don't waste your time on #electronjs, #flatten or other stuff.
Tauri is light and too easy.
Check out the Tauri site:
#rust #rustlang #javascript #typescript #npmjs #npm #cargo #programming #program #code #hacker #hack #gui #uidesign #ui #uxdesign #ux
https://tauri.app/

Totally unrelated: I wonder how many people using libheif-js through heic-decode and heic-convert on #npmjs are actually violating #libheif's license, because heic-decode and heic-convert are not LGPL licensed even though libheif-js is, and most people probably use them without digging through the licenses of the dependencies.

Always fun when npm’s publish authentication route 404s.

#NodePackageManager #npm #npmjs #js #node

@Perl There’s something to be said for putting a small speed bump in front of #developers before they can post #software to a well-indexed central repository: “One In Two New #npm Packages Is #SEO #Spam Right Now” https://blog.sandworm.dev/one-in-two-new-npm-packages-is-seo-spam-right-now

How to start with #Perl’s #CPAN via #PAUSE:
1) Read https://www.cpan.org/modules/04pause.html
2) Visit https://pause.perl.org

#JavaScript #Node #NodeJs #NpmJs #Yarn #MetaCPAN