---
title: "Node-RED 1.0 and a look at the security issues of lockfiles"
publication: "Node Weekly"
issue: 308
published_at: "2019-10-03"
canonical_url: "https://nodeweekly.com/issues/308"
---

This week's Node.js news, tutorials, and projects       

#308 — October 3, 2019 

[Read on the Web](https://nodeweekly.com/issues/308)   

Node Weekly 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/ji2gcuvkf2irvu0bldtp.jpg)](https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/)   

[How `npm` Lockfiles Can Be a Security Blindspot for Injecting Malicious Modules](https://snyk.io/blog/why-npm-lockfiles-can-be-a-security-blindspot-for-injecting-malicious-modules/) — _“Let me show you how easy it is to introduce back doors that are easily missed by project owners… leaving your code insecure.”_ This is a subtle issue, but we’ve seen how such issues can turn into big problems down the line recently. 

Liran Tal   

[Node-RED 1.0 Released](https://nodered.org/blog/2019/09/30/version-1-0-released) — Node RED is a flow-based, visual programming tool (aimed primarily at hardware automation) that’s built on top of Node.js. Despite only reaching 1.0 now, it’s a mature project. 

Nick O'Leary   [![\](https://copm.s3.amazonaws.com/ca4bf587.png)](https://www.datadoghq.com/dg/apm/ts-node-performance/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-NodeWeeklyAPMP) 

[Monitor and Analyze Node App Performance in Real-Time](https://www.datadoghq.com/dg/apm/ts-node-performance/?utm_source=Advertisement&utm_medium=CooperPress&utm_campaign=CooperPress-NodeWeeklyAPMP) — Search and analyze distributed traces to resolve bottlenecks and latency in your Node apps. Try Datadog free. 

Datadog APM sponsor    

[npm Turns 10 Years Old](https://blog.npmjs.org/post/188070866415/npm-turns-10) — It took a couple of years to really explode in use, but `npm` came out not too long after Node itself. npm Inc. celebrates with a brief 54 second video skimming through npm’s growth and releases. 

The npm Blog   

[A Look at V8 v7.8](https://v8.dev/blog/v8-release-78) — Every six weeks we’re treated to a look at the newest release of the V8 JavaScript engine (which Node tends to adopt about a month later). v7.8 continues to improve performance (such as with faster object destructuring) and has some improvements for WebAssembly users too (there’s now a way to use V8 solely as a WebAssembly execution engine from C/C++). Roll on November. 

Ingvar Stepanyan   

[Node.js 8 is Not Supported from 2020 (So Update Now)](https://blog.risingstack.com/update-nodejs-8-end-of-life-no-support/) — Did you know that Node 8 won’t get any more maintenance updates after December 31 this year? Here’s how to think about migrating. 

Tamas Kadlecsik and Ferenc Hámori   

[Node v12.11.1 (Current) Released](https://nodejs.org/en/blog/release/v12.11.1/) — A very minor release that fixed a regression that prevented being able to build Node 12.11.0 from the official tarball. 

Node.js Foundation  

💻 Jobs  

[Your Princess (or Prince!) IS in this Castle: Node Developer (London)](https://careersjs.com/jobs/your-princess-or-prince-is-in-this-castle--node-js-developer-in-central-london/?utm_source=cooperpress&utm_medium=nodeweekly&utm_campaign=cpsep2019&utm_content=OSC1225) — This role is for a senior JS/Node/React dev who can’t wait to tackle more architectural responsibility at a large, well-known company with a passion for saving folks money. 

CareersJS   

[Find A Job Through Vettery](https://www.vettery.com/tech?utm_source=newsletter&utm_medium=cooper-nodeweekly&utm_term=tech&utm_content=grouped&utm_campaign=ad-88879) — Vettery specializes in tech roles and is completely free for job seekers. Create a profile to get started. 

Vettery  

📚 Articles and Tutorials  

[How to Build Cross-Platform, Native Desktop Apps with NodeGUI](https://hibbard.eu/node-gui/) — A beginner’s guide to [NodeGUI](https://github.com/nodegui/nodegui), a tool for building native desktop applications with JavaScript and CSS styling in a more lightweight way than using Electron. 

James Hibbard   

▶[Let's Build a 16-Bit Virtual Machine in JavaScript](https://www.youtube.com/watch?v=fTBwD3sb5mw) — This is a ‘rabbithole which goes really deep’ warns Francis, but you’ll learn a lot of interesting things along the way. 

Low Level JavaScript   

[Top 10 GitHub Best Practices - Lessons from Thousands of Repositories](https://try.datree.io/github-best-practices-guide?utm_source=cooperpress&utm_medium=nodeweekly) — Implementing these best practices could save you time, improve code maintainability, and prevent security risks. 

Datree.io sponsor   

[Crafting Build Pipelines with Docker](https://blog.logrocket.com/crafting-build-pipelines-with-docker/) — An exploration of using a multi-stage build for a Node.js application. 

Ashley Davis   

[Working with Node.js on Hyper-V and WSL2](https://blog.logrocket.com/working-with-node-js-on-hyper-v-and-wsl2/) 

Brian De Sousa   

[Starting Your Own Community Lunch Group](https://techhumans.com/2019/09/22/starting-your-own-community-lunch-group.html) — Not Node specific but something worth doing if you have the right people nearby. 

Keith R. Bennett   

[How to Generate a PDF Using Node, React, and Headless Chrome](https://www.pdftron.com/blog/react/react-to-pdf/) 

Logan Bittner  

🛠 Code and Tools  

[nvm 0.35.0: A Script to Manage Multiple Node Versions](https://github.com/nvm-sh/nvm) — Perhaps the most popular way to manage multiple Node installs on the same machine. It doesn’t get a new release very often, so enjoy. [nave](https://github.com/isaacs/nave) is a similar tool with a different approach if you’re surveying this area. 

nvm.sh   

[OIDC Provider: OpenID Certified OAuth 2.0 Authorization Server Implementation](https://github.com/panva/node-oidc-provider) — An OAuth 2.0 Authorization Server with OpenID Connect and additional features and standards implemented. 

Filip Skokan   

[Typegoose: Define Mongoose Models using TypeScript Classes](https://github.com/typegoose/typegoose) — If you’re a Node developer and using [Mongoose](https://mongoosejs.com/) and want to be using TypeScript, this is for you. 

Typegoose   

[Try Studio 3T: The Best Way to Get Started with MongoDB](https://studio3t.com/download/?utm_source=cooper&utm_medium=newsletter&utm_campaign=nodeoct3) 

Studio 3T sponsor   

[Taiko: A Library and REPL to Automate Chrome](https://github.com/getgauge/taiko) — Includes a REPL mode and is more designed to work with a visible, rather than headless, browser instance. 

Gauge   

[timequeue.js: A Queue with Custom Concurrency and Time Limits](https://github.com/fent/timequeue.js) 

Fent   

[node-rate-limiter-flexible: Limit Number of Actions by Key and Protect Apps from Brute Force Attacks](https://github.com/animir/node-rate-limiter-flexible) 

Roman Animir        

Curated by [Cooperpress](https://cooperpress.com/) and [Peter Cooper](https://twitter.com/peterc). 

[Change your email address](https://nodeweekly.com/edit_subscription/*|UID|*) or[Stop getting this newsletter](https://nodeweekly.com/leave/*|UID|*) 

© Cooper Press Ltd · Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom