--- title: "What hides in your node_modules?" publication: "Node Weekly" issue: 428 published_at: "2022-03-10" canonical_url: "https://nodeweekly.com/issues/428" --- Plus Node 17.7.0, a dive into streams, and managing processes with PM2. | #​428 — March 10, 2022 [Read on the Web](https://nodeweekly.com/issues/428) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/knuhuxscyfpp9eipnwer.jpg)](https://socket.dev/blog/inside-node-modules) [What's Really Going On Inside Your `node_modules` Folder?](https://socket.dev/blog/inside-node-modules) — A running joke is that `node_modules` folders are so huge they’re [heavier than black holes](https://i.redd.it/tfugj4n3l6ez.png) but when packages get taken over by nefarious groups, the contents of node_modules becomes somewhat less funny. This post looks into what malicious packages can do and the broad problem of supply chain attacks generally. Feross Aboukhadijeh [Node v17.7.0 (Current) Released](https://nodejs.org/en/blog/release/v17.7.0/) — Updates to nghttp2 and npm (8.5.2), some [new options](https://github.com/nodejs/node/pull/41310) for `net.Socket` and `net.Server`, and Ben Noordhuis (one of the most prolific Node contributors who [stepped back](https://nodejs.org/fa/blog/uncategorized/bnoordhuis-departure/) as a core committer for [reasons](https://github.com/joyent/libuv/pull/1015#issuecomment-29568172) in 2013) is officially fully back as a Node.js collaborator (though he has [continued](https://github.com/nodejs/node/commits?author=bnoordhuis) to contribute code all along). Stewart X Addison [![\](https://copm.s3.amazonaws.com/ee129dc0.png)](https://buildkite.com/blog/introducing-the-elastic-ci-stack-for-ec2-mac) [Introducing the Elastic CI Stack for EC2 Mac](https://buildkite.com/blog/introducing-the-elastic-ci-stack-for-ec2-mac) — This new open source stack is created specifically for mobile teams, helping you migrate to AWS-managed servers for increased reliability, security, and speed. 📱 Buildkite sponsor [Socket: See Potential Security Issues for `npm` Packages](https://socket.dev/blog/introducing-socket) — An interesting new project that scans the code of each npm package in an attempt to characterize their behavior which is then reported on project specific pages, such as [this one for lodash](https://socket.dev/npm/package/lodash) or [this one for zx](https://socket.dev/npm/package/zx). Socket [A Case Study on Moving from Next.js to Remix](https://www.adamcollier.co.uk/blog/moving-from-next-to-remix) — [Remix](https://remix.run) is the newest full stack Web framework on the block, and the first case studies are beginning to come in. In this case, the author covers the rewrite of his personal site (where this article is hosted). Adam Collier [Making a Discord Playlist Bot with Serverless Cloud](https://www.serverless.com/blog/making-a-discord-playlist-bot-with-serverless-cloud) — _Serverless Cloud_ is a serverless platform from Serverless Inc., the folks behind [Serverless Framework](https://www.serverless.com/framework). (Have we said ‘serverless’ enough yet?) This post ties together Node.js with some specific Serverless Cloud features to easily create a Discord chat bot that can add songs to a shared Spotify playlist. Ben Miner 💻 Jobs [Senior Backend Developer](https://bitovi.applytojob.com/apply/ddJgMjxN3C/Backend-Nodejs-Developer-Consultant-Remote-Full-Time?source=nodewkly) — Are you looking to level up your skills and work on a wide variety of applications and technologies? Look no further. Bitovi [Fullstack Developer](https://grnh.se/024ef2313us) — Konrad is hiring Fullstack developers to join our team in building products for the world’s most exciting companies. Konrad Group [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired [A Guide to Node Process Management with PM2](https://blog.appsignal.com/2022/03/09/a-complete-guide-to-nodejs-process-management-with-pm2.html) — [PM2](https://github.com/Unitech/pm2) is one of the longest standing Node utilities used for managing processes and is worth checking out if you have a Node process you need to stay up 24/7. Ayooluwa Isaiah [Malicious Node.js Packages: Niche Configurations & Invisible Characters](https://snyk.io/blog/visibly-invisible-malicious-node-js-packages-when-configuration-niche-meets-invisible-characters/?utm_campaign=AOM-UA-2022&utm_medium=Paid-Email&utm_source=Cooperpress-Node-Weekly&utm_content=invisible-malicious-node-js-packages) Snyk sponsor [Diving into Node's Streams](https://nodesource.com/blog/dive-into-NodeJs-streams) — Streams provide a defined interface and abstraction over the idea of working with streaming data in Node – they seem to suffer from often being misunderstood, though, so tutorials always tend to be popular. Juan José Arboleda ▶[USB Reverse Engineering and Writing Drivers](https://www.youtube.com/watch?v=is9wVOKeIjQ) — If you’ve got a hankering to do some hardware hackery with Node, you might enjoy this truly low level stream. Low Level JavaScript ▶[Discussing Securing the Open Source Supply Chain with Feross Aboukhadijeh](https://changelog.com/podcast/482) — Feross Aboukhadijeh is one of the minds behind Socket (featured above) and he joined the popular _Changelog_ podcast to discuss the launch and why making the assumption that all your dependencies are malicious may be a necessary step to take. The Changelog podcast [Deploying Your Node API to AWS Using Elastic Beanstalk](https://vkontech.com/deploying-your-node-api-to-aws-using-elastic-beanstalk-demo-project/) Vasil Kosturski [The Fetch API is Finally Coming to Node](https://blog.logrocket.com/fetch-api-node-js/) Elijah Asaolu 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/rmx9mhempnqdpfaexg14.jpg)](https://webtoon.github.io/psd/) [PSD: A Zero-Dependency PSD (Photoshop) Parser for Browser and Node.js](https://webtoon.github.io/psd/) — Will parse info for each layer including text and also supports Photoshop’s .psb (big image) format. [GitHub repo](https://github.com/webtoon/psd). webtoon [Undici 4.15: The Fresh HTTP/1.1 Client for Node](https://github.com/nodejs/undici/releases/tag/v4.15.0) — Undici’s goal to be the best HTTP/1.1 client for Node takes another step forward. Matteo Collina [Bree 8.0: A Versatile Job Scheduler for Node](https://jobscheduler.net/) — Supports cron, dates, ms, later, and human-friendly for scheduling things. Nick Baugh [Stream Video in Your Node App in Two API Calls](https://get.mux.com/32vVwLm) Mux sponsor [exiftool-vendored: Fast, Cross-Platform Node.js Access to ExifTool](https://github.com/photostructure/exiftool-vendored.js) — Use this when you want to access embedded EXIF data within image files (particularly those taken with phones or DSLRs). PhotoStructure [elasticsearch-js 8.1.0: Official Elasticsearch Client for Node](https://github.com/elastic/elasticsearch-js) — [Elasticsearch](https://github.com/elastic/elasticsearch) is a great open source search database system for adding powerful search features to your apps. This update adds Elasticsearch 8.1 compatibility. elastic [AVA 4.1: The Node.js Test Runner](https://github.com/avajs/ava) — A popular test runner known for its simplicity and speed. AVA [fastify-websocket: Basic WebSocket Support for Fastify](https://github.com/fastify/fastify-websocket) Fastify [Dynamodump 2.0: A CLI Tool for Backing Up and Restoring Schema and Data from DynamoDB](https://github.com/mifi/dynamodump) Mikael Finstad [ssh2 v1.7: Pure JavaScript SSH2 Client and Server Modules for Node](https://github.com/mscdex/ssh2) Brian White **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)