--- title: "npm passes the 1 million package milestone" publication: "Node Weekly" issue: 291 published_at: "2019-06-06" canonical_url: "https://nodeweekly.com/issues/291" --- This week's Node.js news, tutorials, and projects #291 — June 6, 2019 [Read on the Web](https://nodeweekly.com/issues/291) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/ylydsxld0r0vrnuykrbo.jpg)](https://blog.npmjs.org/post/185397814280/plot-to-steal-cryptocurrency-foiled-by-the-npm) [How the npm Security Team Foiled a Criminal Plot](https://blog.npmjs.org/post/185397814280/plot-to-steal-cryptocurrency-foiled-by-the-npm) — Several months ago, the [_event-stream_ package was compromised](https://schneider.dev/blog/event-stream-vulnerability-explained/) in an attempt to attack people’s cryptocurrency wallets and the potential loot proved too tempting to the latest set of crooks who have been thwarted by the npm, Inc. security team. The npm Blog [npm Passes The 1 Million Package Milestone](https://snyk.io/blog/npm-passes-the-1-millionth-package-milestone-what-can-we-learn/) — Not only is Node.js 10 years old, there are now also, quite coincidentally, 1 million npm packages (though npm’s own 10th birthday is next year). Rumors suggest only about 23% of the packages belong to Sindre Sorhus. Liran Tal [![\](https://copm.s3.amazonaws.com/3dcdcdc6.png)](https://www.datadoghq.com/dg/apm/ts-node-performance/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-NodeWeeklyAPMP) [Measure the Health and Performance of Your Node Applications with Datadog APM](https://www.datadoghq.com/dg/apm/ts-node-performance/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-NodeWeeklyAPMP) — Get detailed performance data from your Node.js apps and the underlying infrastructure with Datadog. Try Datadog free. Datadog sponsor [Node v12.4.0 (Current) Released](https://nodejs.org/en/blog/release/v12.4.0/) — The continuing velocity of Node releases continues to impress. This time, you can now override the default HTTP server socket timeout (of 2 minutes) using the `--http-server-default-timeout` flag, Node’s JSON-based documentation ([example](https://nodejs.org/api/cluster.json)) is now considered stable, and you can now use the `--heap-prof` flag to run the V8 heap profiler and write the results to disk on exit. Node.js Foundation [node-libcurl 2.0: `libcurl` Bindings for Node](https://github.com/JCMais/node-libcurl) — [libcurl](https://curl.haxx.se/libcurl/) is a _very_ powerful and well established way to fetch data from URLs across numerous protocols. In [version 2.0.0](https://github.com/JCMais/node-libcurl/releases/tag/v2.0.0), support for Node 4 and 6 is dropped, Node 12 is added, along with lots of fixes and increased support for libcurl’s features. Jonathan Cardoso Machado [Switch From Medium to Your Own Blog in a Few Minutes](https://github.com/mathieudutour/medium-to-own-blog) — This is a Node project, but I’m mostly featuring it because I would _love_ if more people we linked to were using their own blog instead of the nightmare that is Medium. [Here’s an example](https://mathieudutour-blog.netlify.com) of the end result, but you can tune it to your own tastes. Mathieu Dutour [Node.js's 10 Year History on a Timeline](https://blog.risingstack.com/history-of-node-js/) — Last week we [celebrated](https://nodeweekly.com/issues/290) Node’s tenth birthday, and the RisingStack folks have now updated their Node.js history timeline too. How far we’ve come! Gergely Nemeth 💻 Jobs [Node.js Developer at X-Team (Remote)](https://x-team.com/remote-nodejs-developer-jobs/?utm_source=cooperpress&utm_medium=email-ad&utm_campaign=node) — Join the most energizing community for developers. Work from anywhere with the world's leading brands. X-Team [Land a New Dev Job on Vettery](https://www.vettery.com/tech?utm_source=newsletter&utm_medium=cooper-nodeweekly&utm_term=tech&utm_content=grouped&utm_campaign=ad-88879) — Vettery specializes in tech roles and is completely free for job seekers. Vettery 📚 Tutorials [How to Mock Services Using Mountebank and Node](https://www.digitalocean.com/community/tutorials/how-to-mock-services-using-mountebank-and-node-js) — A service mock is code that simulates a service that is not yet available (or is otherwise inconvenient to call frequently) in order to test an application. [Mountebank](http://www.mbtest.org/) is a powerful way to create them. Dustin Ewers [A Guide to Rolling Your Own Node Authentication](https://softwareontheroad.com/nodejs-jwt-authentication-oauth/) — The real title is _“You don’t need passport.js”_ but while it’s a good exercise to implement your own authentication system to understand the details, middleware like [Passport](http://www.passportjs.org/) does make the process easier. Santiago Quinteros [Webinar: Node.js and Serverless (June 11)](https://pages.nodesource.com/nodejs-and-serverless-webinar-0619-nw.html) NodeSource sponsor [How to 'Notarize' Your Electron Application for macOS](https://kilianvalkhof.com/2019/electron/notarizing-your-electron-application/) — If you want Electron apps you create to run on macOS without any complaints, this is a must read. Kilian Valkhof [How to Write End-to-End Tests for Next.js Apps](https://buttercms.com/blog/how-to-test-nextjs-apps) — [Next.js](https://nextjs.org/) is popular React framework for PWAs and server-rendered apps. ButterCMS [My Opinionated `git` Cheat Sheet](https://www.bennadel.com/blog/3587-my-opinionated-git-cheat-sheet.htm#blog-post) — Not Node specific but we came across this several weeks ago and have been saving it up for a quiet week as it’s quite useful. Ben Nadel 🛠 Code and Tools [AVA 2.0: A Powerful Test Runner for Node](https://github.com/avajs/ava#README) — AVA is a popular choice for testing with its concise API, process isolation and detailed error output. [2.0](https://github.com/avajs/ava/releases/tag/v2.0.0) has several breaking changes but feature wise is a gentle evolution on 1.0. AVA [Express Rate Limit: Basic Rate-Limiting Middleware for Express.js](https://github.com/nfriedly/express-rate-limit) — Limit repeated requests to public APIs or sensitive endpoints such as password resets. Nathan Friedly [Safely Roll Out New Features in Node with Optimizely Rollouts](https://www.optimizely.com/rollouts-signup/?utm_source=nodeweekly&utm_medium=paid&utm_campaign=2019_05_optimizely_rollouts_nodeweekly) — Ship faster with less risk. Get free feature flags to instantly turn on or off features without deploys. Optimizely Rollouts sponsor [A Serverless Component to Transcribe Audio Stored in an S3 Bucket](https://github.com/simalexan/s3-lambda-transcribe-audio-to-text-s3) — A template and function for turning an S3 bucket of audio into an S3 bucket of transcriptions via AWS Lambda and Amazon Transcribe. Alexander Simovic [MQTT.js: An MQTT Client for Node and the Browser](https://github.com/mqttjs/MQTT.js) — [MQTT](http://mqtt.org/) is a messaging protocol commonly associated with IoT. A new release this week adds support for MQTT 5. MQTT.js [node-gitlab: A GitLab API Library with Complete API Support](https://github.com/jdalrymple/node-gitlab) Justin Dalrymple [Code to Scrape Subreddits using Puppeteer](https://github.com/pitops/reddit-bot-scraper) — You don’t need to do this as Reddit has [a generous API](https://www.reddit.com/dev/api/) (including publicly accessible JSON versions of most pages) but this repo could help if you want a Puppeteer example to learn from. Petros Kyriakou Curated by [Cooperpress](https://cooperpress.com/) and [Peter Cooper](https://twitter.com/peterc). [Change your email address](https://nodeweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://nodeweekly.com/leave/*|UID|*) © Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom