npm Blog Archive: The security risks of changing package owners
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. When I ask software developers what their biggest security concerns are, I typically hear something about malicious code in their npm packages. The average npm package has over 2000 dependencies, so the worry over malware makes a lot of sense. The npm security team certainly
npm Blog Archive: Continuous Security
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. It’s been almost a year since npm acquired ^Lift Security and even less since the official formation of the internal npm Security Team. In addition to working on securing the Registry and its users, I’ve been setting aside time to think through how we look at security at npm
npm Blog Archive: Next Generation Package Management
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. What if installs were so fast they could happen in the background, just by using Node? What if every file in your dependencies could be guaranteed to be bit-by-bit identical to what’s on the registry? What if working on a new project was as simple as clone and run? What if y
npm Blog Archive: npm Joins ECMA International and TC39
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. We’re excited to announce that npm has joined ECMA International and is participating in TC39, the working group of ECMA International that defines the standard for the JavaScript programming language. (The standard is, strictly speaking, called ECMAScript, although everyone
npm Blog Archive: New Package Moniker rules
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. We’ve recently made some changes to how package naming works to better fight typosquatting, and help package authors pick names that stand out. You might have read our post earlier about typosquatting on the npm registry. We responded to this incident with some internal tool
npm Blog Archive: `crossenv` malware on the npm registry
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. On August 1, a user notified us via Twitter that a package with a name very similar to the popular cross-env package was sending environment variables from its installation context out to npm.hacktask.net. We investigated this report immediately and took action to remove the
npm Blog Archive: announcing free Orgs
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. Today, we’re excited to announce that npm Orgs, our collaboration tool for helping teams manage permissions and share their code, is free for all developers of open source packages. You may invite an unlimited number of collaborators to manage an unlimited number of public p
npm Blog Archive: solving npm’s hard problem: naming packages
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. There are only two hard things in Computer Science: cache invalidation and naming things. —Phil KarltonNaming things is hard. It’s even harder when there are tens of thousands of other people who want to use the same names that you do. With 141,898 modules on npm, it has bee
npm Blog Archive: npm private modules are coming soon!
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. We know you’ve all been eagerly waiting… because you’ve been telling us. A lot. We’re really happy to say that we are very close to the release of npm private modules. You can keep your private code private while still getting all of the benefits of having it on npm: depende
npm Blog Archive: npm and front-end packaging
The npm blog has been discontinued. Updates from the npm team are now published on the GitHub Blog and the GitHub Changelog. We’ve known for a while that front-end asset and dependency management is a huge use-case for npm and a big driver of Node.js adoption in general. But how big, exactly? It’s a hard question to answer. The list of most-downloaded packages on npm is not very helpful: packages
1
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
npm Blog Archive: Rethinking JavaScript Test Coverage