---
title: "A thorough examination of an exploited npm package"
publication: "Node Weekly"
issue: 294
published_at: "2019-06-27"
canonical_url: "https://nodeweekly.com/issues/294"
---

This week's Node.js news, tutorials, and projects       

#294 — June 27, 2019 

[Read on the Web](https://nodeweekly.com/issues/294)   

Node Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/og3pjkqph5emwstpj979.jpg)](https://www.youtube.com/watch?v=2cyib2MgvdM)   

▶[Let's Analyze an Exploited NPM Package](https://www.youtube.com/watch?v=2cyib2MgvdM) — A very neat talk from an experienced speaker and Web security expert that digs into the [event-stream security vulnerability](https://schneider.dev/blog/event-stream-vulnerability-explained/) that was big news last year. Here’s how it happened, how the vulnerability worked, and how to mitigate similar problems in future. 

Jarrod Overson   

[Execa 2 Released: Better Process Execution From Node](https://medium.com/@ehmicky/execa-v2-20ffafeedfdf) — Execa improves upon Node’s [child_process module](https://nodejs.org/api/child_process.html) in a variety of ways. 2.0 introduces more features including TypeScript support, process cancellation and being able to interleave stdout and stderr output from other processes. [GitHub repo](https://github.com/sindresorhus/execa). 

ehmicky   [![\](https://copm.s3.amazonaws.com/bb998355.png)](https://try.digitalocean.com/nodejs-hosting/?utm_medium=display&utm_source=paid_newsletter_cooperpress_nodeweekly&utm_campaign=DO_Dev_Signup_Cold_Cooperpress) 

[Deploy Node.js Apps on the Developer Cloud](https://try.digitalocean.com/nodejs-hosting/?utm_medium=display&utm_source=paid_newsletter_cooperpress_nodeweekly&utm_campaign=DO_Dev_Signup_Cold_Cooperpress) — Get flexible server configurations sized for any Node.js project with simple, predictable pricing. 

DigitalOcean sponsor   

[npm 6.9.1 Released After Long Delay](https://npm.community/t/release-npm-6-9-1/8435) — Last week we mentioned the long awaited status of npm 6.9.1 and the possible [‘strike’](https://gist.github.com/aeschright/8ed09cbc2a4aee00fcb4ad35086d76a6) in ongoing community work on the project, but npm’s Isaac Z. Schlueter has stepped up, got a release out, and says there’ll be another release soon. 

npm forum   

[npm Inc. Secures Funding to Take It Into 2020?](https://twitter.com/JavaScriptDaily/status/1144253574400106496) — The story itself is behind a paywall, but allegedly the CEO of npm Inc. has emailed employees saying they’ve secured funding to reduce any cashflow risk until ‘early 2020’. 

JavaScript Daily on Twitter   

[V8 Release v7.6](https://v8.dev/blog/v8-release-76) — Another day, another branch of V8 is on the boil and headed to a Chrome 76 and future version of Node near you soon 😄 This time, the heavily used `JSON.parse` gets some significant performance improvements, `BigInt` now has better API support, we gain `Promise.allSettled`, and more. 

Adam Klein   

[Just: A JavaScript Task Library from Microsoft](https://microsoft.github.io/just/) — If you’re familiar with Ruby’s `rake`, it’s a bit like that. Define tasks in JavaScript, run them with `just` (which works fine without installation using `npx`) and you get a bunch of nice features like [logging](https://microsoft.github.io/just/docs/logging) and [task composition](https://microsoft.github.io/just/docs/composition). 

Microsoft  

💻 Jobs  

[Senior Node.js API Engineer - Exodus (Remote)](https://www.exodus.io/careers/#senior-node-api-engineer) — Do you live for beautiful APIs? We're looking for a meticulous, obsessive leader to focus on our backend API services. 

Exodus   

[Find a Node Job on Vettery](https://www.vettery.com/tech?utm_source=newsletter&utm_medium=cooper-nodeweekly&utm_term=tech&utm_content=grouped&utm_campaign=ad-88879) — Vettery specializes in tech roles and is completely free for job seekers. 

Vettery  

📚 Opinion & Tutorials  

[The Secret of Good Electron Apps](https://jlongster.com/secret-of-good-electron-apps) — Without being too spoilery, the ‘secret’ to making better Electron apps is to take as much of the processing local to the app itself rather than relying entirely upon remote services (i.e. just being a glorified Web browser). 

James Long   

[`Object.fromEntries`](https://v8.dev/features/object-fromentries) — The new `Object.fromEntries` API performs the inverse of `Object.entries`. This makes it easy to reconstruct an object based on its entries. It’s supported in Node 12 and above. 

Mathias Bynens   

[Product Announcements: MongoDB 4.2, Auto Scale, Full-Text Search, Data Lake & more](https://www.mongodb.com/new?jmp=cpress&utm_campaign=WW_CP_newsletter_sponsorship&utm_content=20190627&utm_medium=display&utm_source=nodeweekly) — Explore new MongoDB product announcements and watch the product keynote delivered by CTO & Co-Founder Eliot Horowitz. 

MongoDB sponsor   

[How to Deploy a Node App to DigitalOcean with HTTPS](https://coderrocketfuel.com/article/deploy-a-nodejs-application-to-digital-ocean-with-https) — A beginner level tutorial that takes you through every tiny step. 

Coder Rocket Fuel   

▶[Discussing TypeScript and Linters with Adam Argyle](https://www.youtube.com/watch?v=_ECuXk4MX6Y#t=3m2s) 

Fun Fun Function  

🛠 Code and Tools  

[Grant: OAuth Middleware for Express, Koa and Hapi](https://github.com/simov/grant) — Supports 180 different OAuth providers. 

Simeon Velichkov   

[registry-js: A Library for Working with the Windows Registry](https://github.com/desktop/registry-js) — Built by the GitHub Desktop team for use with the GitHub client and Atom. 

GitHub   

[AutoServer: Create A Full REST/GraphQL API from a Config File](https://github.com/ehmicky/autoserver) 

ehmicky   

[Manifold Launches Marketplace-as-a-Service](https://www.manifold.co/blog/announcing-marketplace-as-a-service-for-developer-platforms?utm_source=newsletter&utm_medium=node_weekly&utm_campaign=june27) 

Manifold sponsor   

[password-leak: A Library to Check for Compromised Passwords](https://github.com/mathiscode/password-leak) — It checks against the popular [Have I Been Pwned API](https://haveibeenpwned.com/API/v2). 

J.R. Mathis   

[log-with-statusbar: A Logger with a Status Bar That Doesn't Disappear](https://github.com/ourarash/log-with-statusbar) — Lets you run a regular log alongside an unshifting status bar. 

Ari   

[FarmHash 3.0: A Node Implementation of Google's High Performance Hash Functions](https://github.com/lovell/farmhash) — [FarmHash](https://github.com/google/farmhash) is a family of non-cryptographic hash functions built by Google mostly for quickly hashing strings. 

Lovell Fuller   

[Simple Git: A Lightweight Interface for Running Git Commands in Any Node App](https://github.com/steveukx/git-js) 

Steve King         

Curated by [Cooperpress](https://cooperpress.com/) and [Peter Cooper](https://twitter.com/peterc). 

[Change your email address](https://nodeweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://nodeweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom