Bookmarks (52) clear filters

npm 6.14 Released — The main addition is support for multiple ‘funding’ entries for package maintainers to demonstrate multiple ways their work can be supported. 6.14.1 followed shortly thereafter to fix a regression.

A Day in the Life of npm Security — André Eleuterio is the ‘vulnerability coordinator of that npm security inbox’ which means he gets to analyze all of the various vulnerability reports coming in regarding npm packages.

Changes to npm's 'Unpublish' Policy — Till now you couldn’t easily ‘unpublish’ packages (or individual versions) from the main npm repository if they were older than 72 hours but now you can if your package meets certain criteria (no dependents, fewer than 300 downloads in the past week, and a single owner/maintainer).

npm Security 2019 in Review — npm Inc’s VP of Security, Adam Baldwin, shares a variety of stats relating to the security of the npm repository over the past year. A stand out is that only 9.27% of package maintainers are using 2FA so far (consider correcting that ASAP if you’re one of the 90% left! 😄)

npm 6.13.4 Released, Please Upgrade — There have been two key bugfix releases this week – this is the latest. Why upgrade? Because in npm 6.13.2 and earlier, a nefarious package publisher could put something into their package.json that would let them modify arbitrary files on your system. Luckily, no examples of this attack have yet been found by npm’s security team.

New npm Products and a Glimpse Ahead — npm Pro is a new (paid – $7/mo) offering from npm Inc. (the owners of the npm package repository) that lets you publish an unlimited number of private packages via npm if you so wish. There’s also Teams (formerly ‘Orgs’) which goes a step further with team management.

npm Security Insights API Preview Part 3: Behavioral Analysis — The npm team are working on a new API to provide insights into packages to npm users. One thing it’ll provide is information about how packages behave, such as making network requests or executing processes.

npm Inc.'s Community, Docs, and npm 7 Update — A lengthy blog post that includes a variety of updates from npm Inc. Key points:

npm 6.12.1 Released — A few minor bugfixes and Node 13 (released last week) is now an officially supported version (a warning message was shown before).

npm 6.12.0 Released — Now npm ci runs prepare scripts for git dependencies and respects the --no-optional flag.

npm Turns 10 Years Old — It took a couple of years to really explode in use, but npm came out not too long after Node itself. npm Inc. celebrates with a brief 54 second video skimming through npm’s growth and releases.

Avoiding the Tragedy of the Commons: Acceptable Use of the npm Public Registry — Usage of the official npm repository is still growing along a ‘hockey stick’ curve and npm Inc. wants to ensure a high level of service is maintained. As such, their acceptable usage policy now clarifies that making over 5 million requests per month is considered ‘excessive’.

Better Package Selection with npm Enterprise — npm Enterprise lets customers specify policies over which packages can be used and downloaded, and it now lets users look at these more easily.