---
title: "Top security best practices when using npm"
publication: "Node Weekly"
issue: 276
published_at: "2019-02-21"
canonical_url: "https://nodeweekly.com/issues/276"
---

The latest Node.js news, articles, tools, and projects.       

#276 — February 21, 2019 

[Read on the Web](https://nodeweekly.com/issues/276)   

Node Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/tziifowwujm6oapbfico.jpg)](https://snyk.io/blog/ten-npm-security-best-practices/)   

[Ten `npm` Security Best Practices](https://snyk.io/blog/ten-npm-security-best-practices/) — Concerned about npm vulnerabilities? This post covers a lot of ground from avoiding leaving secrets in published npm packages to disclosing vulnerabilities and using 2FA. 

Liran Tal and Juan Picado   

[Node v11.10.0 (Current) Released](https://nodejs.org/en/blog/release/v11.10.0/) — Upgrades for both libuv and npm (to 6.7) and a few (very) minor new features like a [histogram based API](https://github.com/nodejs/node/pull/25378) for perf monitoring and [`repl.setupHistory`](https://github.com/nodejs/node/pull/25895). 

Node.js Foundation   [![\](https://copm.s3.amazonaws.com/d93a6cf7.jpg)](https://frontendmasters.com/courses/design-for-developers/) 

[Design for Developers ✨ New Course by Sarah Drasner](https://frontendmasters.com/courses/design-for-developers/) — Become more self-sufficient for the entire process for execution, from concept to design to implementation. Understand the rules for designing and learn to create complex and beautiful front-end experiences. 

Frontend Masters sponsor   

[The Security Risks of Changing Package Owners](https://blog.npmjs.org/post/182828408610/the-security-risks-of-changing-package-owners) — _“We’ve had a few situations recently which illustrate that people are a layer beneath the code and the actions of maintainers have a direct impact on the security of the ecosystem. Specifically event-stream and koa-router.”_ 

The npm Blog   

[Node.js Core Team Considering Dropping ARMv6 Support for Node 12+](https://github.com/nodejs/build/issues/1677#issuecomment-465326568) — This won’t affect _many_ of you, but if it does (such as if you’re a Pi Zero or Raspberry Pi 1 user), it’s time to have your say. 

Node.js Foundation   

[NodeSource Announces New Pricing for Smaller Teams](https://nodesource.com/blog/announcing-new-pricing-for-smaller-teams) — [N|Solid](https://nodesource.com/products/nsolid) is a mature platform for building and monitoring solid and secure Node apps, but it’s long been available _only_ under enterprise-level pricing. No more. 

NodeSource  

💻 Jobs  

[Sr. Fullstack Engineer (Remote)](https://www.stickermule.com/careers) — Sticker Mule is looking for passionate developers to join our remote team. Come help us become the Internet’s best place to shop and work. 

Sticker Mule   

[UK Tech Jobs? Check Out hackajob](https://hackajob.co/p/discover?utm_source=cooperpress&utm_medium=paid&utm_campaign=nw_feb-21&utm_term=nodejs) — We look at your skills to match you with great companies. They apply to you, salary upfront. 

hackajob  

📘 Tutorials and Opinions  

[`for` vs `forEach()` vs `for`/`in` vs `for`/`of` in JavaScript](http://thecodebarbarian.com/for-vs-for-each-vs-for-in-vs-for-of-in-javascript.html) — An overview of the differences between looping constructs using several different edge cases. 

The Code Barbarian   

[Divide and Conquer: Scale Your Node App using Distributed Queues](https://blog.logrocket.com/divide-and-conquer-scale-your-node-js-app-using-distributed-queues-8231a9486d3a) 

Alberto Gimeno   

[Share Your Whole Stack with Your Team, on Any Cloud, with One Workflow 🧑‍🤝‍🧑](https://blog.manifold.co/manifold-for-teams-share-your-whole-stack-on-any-cloud-with-one-workflow-2386a5779a37?utm_source=newsletter&utm_medium=sponsorship&utm_campaign=NodeWeekly&utm_content=Feb21) 

Manifold sponsor   

[nodejs.dev: A Solid Introduction to Node.js](https://nodejs.dev/) — This week, Google began to offer [`.dev` domain names](https://www.blog.google/technology/developers/hello-dev/) to the public, but [gave the Node.js project a gift](https://medium.com/@nodejs/node-js-selected-by-google-for-dev-top-level-domain-early-access-6b0c5f9205f8) in the form of the [nodejs.dev](https://nodejs.dev/) domain which now hosts Flavio Copes’ awesome _Introduction to Node.js_ guide. 

Flavio Copes   

[Using Node 11.7 Worker Threads with RxJS Observable](https://briandesousa.net/2019/02/16/using-node-11-worker-threads-with-rxjs-observable/) 

Brian de Sousa   

[How to Run Your Node App on a Headless Raspberry Pi](https://dev.to/bogdaaamn/run-your-nodejs-application-on-a-headless-raspberry-pi-4jnn) 

Bogdan Covrig  

🔧 Code and Tools  

[Bull: A Redis-Based Queue for Node](https://github.com/OptimalBits/bull) — Prides itself on both performance and ‘rock solid stability’. Check [the examples](https://github.com/OptimalBits/bull#quick-guide) for an idea of the API. Looks nice. 

Manuel Astudillo   

[Leon: A Node-Powered Open-Source Personal Assistant](https://github.com/leon-ai/leon) — There’s [a demo video](https://www.youtube.com/watch?v=p7GRGiicO1c) if you want to get the idea quickly. 

Louis Grenard   

[Route Your Data to Any Analytics Service from Your Node Code](https://segment.com/docs/sources/server/node/?utm_source=nodenl&utm_medium=email&utm_content=ss) 

Segment sponsor   

[dbus-next: A New DBus Library for Node](https://github.com/acrisci/node-dbus-next) — [DBus](https://en.wikipedia.org/wiki/D-Bus) is a message bus system _currently_ primarily used as a mechanism for Linux desktop apps to talk to each other. 

Tony Crisci   

[fast-cli: Test Your Download and Upload Speed using Fast.com](https://github.com/sindresorhus/fast-cli) — A good example of how a simple Node-powered command line tool can be written and packaged. 

Sindre Sorhus   

[capture-website: Capture Screenshots of Websites](https://github.com/sindresorhus/capture-website) — A high-level Puppeteer wrapper to make it easy to capture screenshots of websites from Node or the command-line. 

Sindre Sorhus         

Curated by [Cooperpress](https://cooperpress.com/) and [Peter Cooper](https://twitter.com/peterc) 

[Change your email address](https://nodeweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://nodeweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom