--- title: "A proposal to make npm safer?" publication: "Node Weekly" issue: 413 published_at: "2021-11-11" canonical_url: "https://nodeweekly.com/issues/413" --- Plus Node-RED's role in industrial settings, and Node 17.1.0's release. | #​413 — November 11, 2021 [Read on the Web](https://nodeweekly.com/issues/413) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/sqfuzcflrnmerh3g9lkk.jpg)](https://docs.umh.app/docs/concepts/node-red-in-industrial-iot/) [Node-RED in Industrial IoT: A Growing Standard](https://docs.umh.app/docs/concepts/node-red-in-industrial-iot/) — [Node-RED](https://nodered.org/) is a very long standing Node.js-based ‘low code’ environment where you wire components together. As explained here, it’s heavily used in IoT scenarios and is even taking on established commercial systems. United Manufacturing Hub [Bree 7.0: A Versatile Job Scheduler for Node](https://jobscheduler.net/) — Supports cron, dates, ms, later, and human-friendly for scheduling things. Made to help run [Forward Email](https://forwardemail.net/en), a neat email forwarding service worth checking out on its own merits. [GitHub repo.](https://github.com/breejs/bree) Nick Baugh [![\](https://copm.s3.amazonaws.com/3b0f3768.png)](https://about.sourcegraph.com/batch-changes/?utm_medium=text&utm_source=node-weekly&utm_campaign=batch-changes&utm_content=primary) [Track Changes From Creation To Merge With Batch Changes](https://about.sourcegraph.com/batch-changes/?utm_medium=text&utm_source=node-weekly&utm_campaign=batch-changes&utm_content=primary) — Understand the total impact of large-scale code changes before you make them and move 75% faster with Batch Changes. See how teams are using Batch Changes from configuration, refactoring, and more. Sourcegraph sponsor **QUICK BITS:** - The next branch of V8 has appeared: [V8 v9.7](https://v8.dev/blog/v8-release-97) – a relatively minor one with `findLast` and `findLastIndex` methods appearing for Arrays and TypedArrays. Wait for a Node release in a month or two, perhaps. - The OpenJS Foundation has [updated its Node.js certification exams](https://openjsf.org/blog/2021/11/09/openjs-node-js-certification-version-update-node-js-14-to-node-js-16/) from Node 14 to Node 16 standards. [Proposal: Make `npm`'s Install Scripts Opt In](https://github.com/npm/rfcs/pull/488) — Recent security issues involving compromised packages are making `npm install`’s ability to run arbitrary commands seem like a risky proposition. A developer kicked off a discussion by suggesting adding some nuance to how common pre/post-install scripts are run (or not). Francisco Ryan Tolmasky I, et al. [Node v17.1.0 (Current) Released](https://nodejs.org/en/blog/release/v17.1.0/) — A reasonably minor release. There’s now support for JSON `import` assertions ([see here](https://github.com/tc39/proposal-import-assertions) for more on what that entails) and [a new `promise_hook` module](https://github.com/nodejs/node/pull/39283) for exposing V8’s PromiseHook API to userland. Michaël Zasso [A Guide to Load Testing Node APIs with Artillery](https://blog.appsignal.com/2021/11/10/a-guide-to-load-testing-nodejs-apis-with-artillery.html) — [Artillery](https://artillery.io/) is a load testing tool, written in JavaScript no less, that can let you test your apps under virtual traffic surges. Ayooluwa Isaiah [How To Work with Files Using Streams in Node](https://www.digitalocean.com/community/tutorials/how-to-work-with-files-using-streams-in-node-js) — Streams provide an efficient mechanism for working with files in Node – this is a practical and straightforward introduction to how to work with them. Adaobi Aniuchi [Notification Systems 2.0: Part 1 - User Requirements](https://www.courier.com/blog/the-developers-guide-user-requirements?utm_campaign=newsletters&utm_source=node-weekly&utm_medium=developers-guide) Courier sponsor [How to Speed Up Your TypeScript Monorepo with `esbuild`](https://mmazzarolo.com/blog/2021-11-06-speed-up-your-typescript-monorepo-with-esbuild/) — Using [esbuild](https://esbuild.github.io/) to compile your TypeScript codebase could hugely improve build times. Matteo Mazzarolo [`sudo rm →rf / === npm install`](https://ghuntley.com/sudo-rm-rf/) — A tale of why copying and pasting random commands from the Internet isn’t a great idea, but then moving on to why install scripts that can ‘run just about anything’ might not be much better. _(Note: Title edited for safety.)_ Geoffrey Huntley 💻 Jobs [Backend Engineer (Remote, EU Timezones)](https://feather-insurance.com/careers/backend-engineer) — We’ve built a product thousands of people love (See [Trustpilot](https://www.trustpilot.com/review/feather-insurance.com) if you don’t believe us). We need your help with Node & TypeScript. Feather [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired 🛠 Code & Tools [Depp: Check `npm` Modules for Unused and Duplicate Dependencies Fast](https://github.com/CryogenicPlanet/depp) — A new Go-powered tool you run from your JavaScript/TypeScript project’s folder to look for unused dependencies. Rahul Tarak [JestTestGen: Generates Jest Unit Test Files for Existing JS/TS Files](https://github.com/egm0121/jest-test-gen) — Auto generation of Jest unit test files with all imports mocked and test stubs for every class method or function exported. Giulio Dellorbo [Slonik v25: A Sophisticated Node Postgres Client Library](https://github.com/gajus/slonik) — A ‘battle tested’ framework that abstracts repeating code patterns, protects against unsafe behavior, and provides a rich debugging experience. Gajus Kuizinas [Tired of Manual Domain Management? Automate with This Special Offer 👀](https://dnsimple.link/node-weekly/2021) DNSimple sponsor [blake-hash: Rust Blake3 Hash Bindings for Node](https://github.com/Brooooooklyn/blake-hash) — [BLAKE3](https://github.com/BLAKE3-team/BLAKE3) ([Wikipedia entry](https://en.wikipedia.org/wiki/BLAKE_%28hash_function%29)) is a cryptographic hash function focused on performance. LongYinan [randoma 2.0: User-Friendly Pseudorandom Number Generator](https://github.com/sindresorhus/randoma) Sindre Sorhus [node-fetch 3.1: Lightweight Module Bringing the Fetch API to Node](https://github.com/node-fetch/node-fetch) Node Fetch **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)