--- title: "📦 Broken packages" publication: "Node Weekly" issue: 420 published_at: "2022-01-13" canonical_url: "https://nodeweekly.com/issues/420" --- Plus a raft of security releases, NAPI-RS 2.0, and a robots.txt parser. | #​420 — January 13, 2022 [Read on the Web](https://nodeweekly.com/issues/420) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/atob1apx6ssqgdj3e7bg.jpg)](https://www.theregister.com/2022/01/10/npm_fakerjs_colorsjs/) [JavaScript Developer Breaks Two Popular npm Packages](https://www.theregister.com/2022/01/10/npm_fakerjs_colorsjs/) — The creator of Faker.js and colors.js, two packages we’ve mentioned quite often, made some _unorthodox_ commits to his projects recently that caused them to either disappear or [break](https://github.com/Marak/colors.js/commit/074a0f8ed0c31c35d13d28632bd8a049ff136fb6?diff=unified) in interesting ways which resulted in GitHub [suspending his access](https://twitter.com/marak/status/1479200803948830724?s=20) at one point. To be blunt, you want to be finding alternatives. _The Register’s_ writeup is, perhaps, one of the more _colorful._ Dependencies continue to [be risky](https://lucumr.pocoo.org/2022/1/10/dependency-risk-and-funding/) and this story will surely trundle on. Thomas Claburn (The Register) [The January 10, 2022 Node.js Security Releases](https://nodejs.org/en/blog/vulnerability/jan-2022-security-releases/) — Updates have arrived for all major release lines to resolve a handful of vulnerabilities. There’s [Node 17.3.1](https://nodejs.org/en/blog/release/v17.3.1/), plus joint LTS releases [16.13.2](https://nodejs.org/en/blog/release/v16.13.2/), [14.18.3](https://nodejs.org/en/blog/release/v14.18.3/), and [12.22.9.](https://nodejs.org/en/blog/release/v12.22.9/) Bryan English and the Node.js Team [![\](https://copm.s3.amazonaws.com/1eddf7b4.png)](https://www.appsignal.com/tour/performance?utm_source=node-weekly-sponsored&utm_medium=email&utm_campaign=2022-01-13) [AppSignal Speaks Louder Than Words](https://www.appsignal.com/tour/performance?utm_source=node-weekly-sponsored&utm_medium=email&utm_campaign=2022-01-13) — AppSignal helps you inspect and improve the performance of your Node.js applications. Enhance your customer's experience, and make sure your apps stay performant. We’ll tell you which piece of code to look at. AppSignal sponsor [What npm Should Do Today to Stop a New Colors Attack Tomorrow](https://research.swtch.com/npm-colors) — _“A misfeature in NPM’s design means that as soon as the sabotaged version of colors was published, fresh installs of command-line tools depending on colors immediately started using it, with no testing that it was in any way compatible with each tool. (Spoiler alert: it wasn’t!)”_ — Russ explains how Go’s approach could avert such an issue. Russ Cox [NAPI-RS 2.0: A Minimal Library for Building Node Addons in Rust](https://napi.rs/blog/announce-v2) — A nifty way to ‘Rustify’ Node and build pre-compiled Node.js addons in the popular systems language. v2 introduces a new macro API for defining JS values in Rust and makes the Rust code _far_ easier to write. Async functions are now also supported, which is dope. [Neon](https://neon-bindings.com/) explores similar ideas in this space. NAPI-RS Team [0x 5.0: Single-Command Flamegraph Profiling for Node](https://github.com/davidmarkclements/0x) — A tool that can profile and generate an interactive flamegraph ([example](http://davidmarkclements.github.io/0x-demo/)) for a Node process in a single command. David Mark Clements 💻 Jobs [Backend Developer Excited About Internet of Things?](https://dimensionfour.io/careers/senior-software-engineer) — Great opportunity to join a remote-friendly company positioned for exponential growth, working with emerging technologies and tools. [Apply now](https://dimensionfour.io/careers/senior-software-engineer). Dimension Four [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired [Using Node.js ES Modules and Top-Level `await` in AWS Lambda](https://aws.amazon.com/blogs/compute/using-node-js-es-modules-and-top-level-await-in-aws-lambda/) — Serverless _AWS Lambda_ functions now support ES modules by way of the Node.js 14.x runtime. Dan Fox [A Red Hat Flavored Review of Node.js in 2021](https://developers.redhat.com/articles/2022/01/10/nodejs-red-hat-2021-year-review#things_we_shipped) — Red Hat has its own Node.js team and this is what they achieved in 2021, including working on Node 17, shipping a variety of [useful cheat sheets](https://developers.redhat.com/cheat-sheets), and work on using Node serverlessly on Red Hat OpenShift. Red Hat Developers [Think Less, Do More: Reducing Cognitive Overhead with ThePrimeagen](https://about.sourcegraph.com/blog/dev-tool-time-theprimeagen/?utm_campaign=dev-influencers-ddg-tofu&utm_medium=newsletter&utm_source=node-weekly) Sourcegraph sponsor [Ask HN: Where Are the Resources for Complex Architectures for Node.js?](https://news.ycombinator.com/item?id=29734398) Hacker News 🛠 Code & Tools [Robots Parser 3.0: A `robots.txt` Parser](https://github.com/samclarke/robots-parser) — If you’re scraping or otherwise making automated requests to other people’s sites, abiding by their `robots.txt` rules is a good practice, and this could help you figure it out. Sam Clarke et al. [Instauto: An Instagram Bot / Automation Library](https://github.com/mifi/instauto) — Uses Puppeteer to do the hard work. The focus here is on ease of use. Mikael Finstad [fast-json-stringify 3.0: 2x Faster than `JSON.stringify()`?](https://github.com/fastify/fast-json-stringify) — It seems apt that _Fastify_ made this library. Fastify [Build Internal Tools in Minutes with Retool, Where Visual Programming Meets the Power of Real Code](https://retool.com/?utm_source=sponsor&utm_medium=newsletter&utm_campaign=nodeweekly) Retool sponsor [Jasmine 4.0: The Testing Framework for Browsers and Node](https://github.com/jasmine/jasmine/blob/main/release_notes/4.0.0.md) — Yes, there are breaking changes (no IE support, no old Node versions support, behavior changes and more) but there’s [a migration guide](https://jasmine.github.io/tutorials/upgrading_to_Jasmine_4.0) to make it simpler if you’re a Jasmine user. Jasmine Team [active-win 7.7.0: Get Metadata About the Active Window](https://github.com/sindresorhus/active-win) — You can use this to get the title, width, height, x and y of the currently active window. Maybe useful for building your own productivity tracker or something? Now supports Apple Silicon natively. Sindre Sorhus [public-ip 5.0: Quickly Get Your Public IP Address](https://github.com/sindresorhus/public-ip) — Queries the DNS records of OpenDNS, Google DNS, and HTTPS services to determine your IP address. Now a pure ES module. Sindre Sorhus [The Official MongoDB Node.js Driver v4.3.0](https://github.com/mongodb/node-mongodb-native/releases/tag/v4.3.0) — Adds SOCKS5 support and key auto-completion support and type hinting on nested documents if you use TypeScript (all explained in these release notes). MongoDB, Inc. [TypeScript Express Starter App 7.0](https://github.com/ljlm0402/typescript-express-starter) — A boilerplate app generator for getting a RESTful API up and running quickly on top of things like PM2, SWC, and Docker. You can choose from sub-templates covering the basics, using Sequelize, Mongoose, TypeORM, Prisma, or Knex too. 아구몬 [SuperTest 6.2: Super-Agent Driven Library for Testing Node HTTP Servers](https://github.com/visionmedia/supertest) — Make assertions about HTTP servers using a fluent API. Sloth **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)