--- title: "A major npm registry vulnerability" publication: "Node Weekly" issue: 414 published_at: "2021-11-18" canonical_url: "https://nodeweekly.com/issues/414" --- Plus would you delete your npm module for money? | #​414 — November 18, 2021 [Read on the Web](https://nodeweekly.com/issues/414) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/joqoxsw1lerbc2plecu2.jpg)](https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/) [GitHub on npm Ecosystem Security (and a Major Bug They've Fixed)](https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/) — GitHub became the custodians of the main npm registry in 2020 when it acquired npm Inc. and in this post they share details on how they’re improving its security. Rather worryingly, they [recently identified two issues](https://github.blog/2021-11-15-githubs-commitment-to-npm-ecosystem-security/#security-issues-related-to-the-npm-registry), one of which meant **an attacker could publish new versions of any npm package** without proper authorization(!) GitHub assures us, however, it has not been _“exploited maliciously”_ during the timeframe for which they have telemetry (September 2020 onward). Mike Hanley (GitHub) [Migrating from Puppeteer to Playwright](https://www.checklyhq.com/guides/puppeteer-to-playwright/) — [Puppeteer](https://developers.google.com/web/tools/puppeteer) is a popular Node library to remote control Chrome/Chromium browsers, whereas [Playwright](https://playwright.dev/) is a little broader and newer. This post digs through what you need to consider if you switch between the two. Checkly [![\](https://copm.s3.amazonaws.com/89625f7b.jpg)](https://frontendmasters.com/courses/realtime/?utm_source=nodeweekly&utm_medium=email&utm_campaign=realtime) [A Complete Intro to Building For Real-Time](https://frontendmasters.com/courses/realtime/?utm_source=nodeweekly&utm_medium=email&utm_campaign=realtime) — Join Brian Holt for this detailed course on building apps that can push client messages up to the server and talk in real-time. You'll learn long polling, how to open web sockets, SocketIO abstraction, HTTP/2 Push, retry strategies, and more. Frontend Masters sponsor [Announcing TypeScript 4.5](https://devblogs.microsoft.com/typescript/announcing-typescript-4-5/) — Just two weeks after the RC comes the final release. What’s new? The formerly promised ES module support for Node is now [merely experimental](https://devblogs.microsoft.com/typescript/announcing-typescript-4-5/#esm-nodejs) and in nightly releases only, but you also get the `Awaited` type, faster load times via Node’s `realpathSync.native`, import assertion support, and support for [the `lib` setting for `node_modules`](https://devblogs.microsoft.com/typescript/announcing-typescript-4-5/#lib-node-modules) so you can update your types on your own terms. Daniel Rosenwasser (Microsoft) ['I Will Pay You Cash to Delete Your npm Module'](https://drewdevault.com/2021/11/16/Cash-for-leftpad.html) — Firstly, it’s a (sort of) joke, but the founder of [sourcehut](https://sourcehut.org/) brings up an interesting point. He’s alarmed by huge trees of dependencies and wants to see people thinking about it, even if no money is involved. Drew DeVault [Bundle Scanner: Identify npm Libraries Used on a Web Page](https://bundlescanner.com/) — Enter a URL and this tool will try and show you what npm packages were used in the page’s JavaScript even if they’re all bundled up. There’s an [explanation of how it works](https://bundlescanner.com/about). Or some [example results](https://bundlescanner.com/website/kentcdodds.com/all) for Kent C Dodd’s [fancy new](https://kentcdodds.com/blog/introducing-the-new-kentcdodds.com) homepage. Markus Englund [Electron 16.0.0 Released](https://www.electronjs.org/blog/electron-16-0) — [Electron](https://www.electronjs.org/), the toolkit for building cross platform desktop apps with JavaScript, is now one of those projects with a fast, regular release cadence, so no _huge_ changes here, but you get Chrome 96, Node 16.9.1 and V8 9.6 support, as well as the [WebHID API.](https://developer.mozilla.org/en-US/docs/Web/API/WebHID_API) OpenJS Foundation [How NodeSource Builds Better Security Monitoring and Alerts with InfluxDB](https://www.influxdata.com/customer/nodesource/?utm_source=vendor&utm_medium=referral&utm_campaign=2021-11-18_spnsr-nl_nodesource-cs_global&utm_content=nodeweekly) InfluxData sponsor [How to Create Memory and Type-Safe Node Modules with Rust](https://levelup.gitconnected.com/create-memory-and-type-safe-node-js-modules-with-rust-2c10bba92013) — We’ve mentioned [Neon](https://neon-bindings.com/) a few times before. It provides a way to write code in Rust that you can call from Node, and this tutorial provides a quick intro. Tharaka Romesh [Using Node.js to Create An HTTP Proxy for IPFS Content](https://blog.logrocket.com/using-node-js-http-proxy-ipfs-content/) — IPFS has some admirable goals, but it’s inaccessible for many users. See how to use Node to create an HTTP proxy to access IPFS content. Alex Merced 💻 Jobs [Backend Engineer (Remote, EU Timezones)](https://feather-insurance.com/careers/backend-engineer) — We’ve built a product thousands of people love (See [Trustpilot](https://www.trustpilot.com/review/feather-insurance.com) if you don’t believe us). We need your help with Node & TypeScript. Feather [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired 🛠 Code & Tools [Clinic.js 10: A Node Performance Diagnosis Suite](https://clinicjs.org/) — A tool to diagnose issues in Node apps with probes that collect metrics to assess the app and create recommendations. v10 adds Node 16 support. [GitHub repo.](https://github.com/clinicjs/node-clinic) nearform [htmlparser2 7.2.0: A Forgiving HTML and XML Parser](https://github.com/fb55/htmlparser2) — Consumes documents and calls callbacks, but it can generate a DOM as well. There’s [a live demo here.](https://astexplorer.net/#/2AmVrGuGVJ) Felix Böhm [Nodekeeper: A Lightweight Alternative to Nodemon](https://github.com/Pankajtanwarbanna/nodekeeper) — Like [nodemon](https://github.com/remy/nodemon) it monitors your app for changes and automatically restarts things, as you might want in development. There’s also [an article on how it works](https://www.pankajtanwar.in/blog/have-you-ever-thought-how-nodemon-works-internally-lets-build-our-own-nodemon-in-under-10-minutes). Pankaj Tanwar [Automate Domains, DNS, and SSL Certificates with This Special Offer 👀](https://dnsimple.link/node-weekly/2021) DNSimple sponsor [Auto: Generate Releases Based on Semantic Version Labels on Pull Requests](https://intuit.github.io/auto/) — A tool with the goal to make automated releases easy and without big changes to your workflow. [GitHub repo](https://github.com/intuit/auto). Intuit [browser-or-node 2.0: Figure Out Where Your Code is Running](https://github.com/flexdinesh/browser-or-node) — Provides a simple way to tell if your code is currently running in a browser, in Node, in a Web Worker, or in Deno. Dinesh Pandiyan [Execa 6.0: A Better `child_process`](https://github.com/sindresorhus/execa) — A way to run external processes from your Node app. Has a Promise-based interface, better support for Windows, allows up to a 100MB max buffer (vs the 200KB `child_process` uses). Now a pure ES module. Sindre Sorhus [The Official MongoDB Node.js Driver v4.2.0](https://github.com/mongodb/node-mongodb-native) — See what’s new in [the release notes](https://github.com/mongodb/node-mongodb-native/releases/tag/v4.2.0). MongoDB, Inc. **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)