--- title: "Damage caused by package-based protest" publication: "Node Weekly" issue: 429 published_at: "2022-03-17" canonical_url: "https://nodeweekly.com/issues/429" --- Plus a neat REPL for Node browser automation from Node, and some OpenSSL-driven security releases. | 🇺🇦 #​429 — March 17, 2022 [Read on the Web](https://nodeweekly.com/issues/429) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/gbahe9yapogrzxxuglio.jpg)](https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/) [`peacenotwar`: How an npm Package Protested Russia's Invasion of Ukraine](https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/) — Users of a variety of systems (including Vue CLI, [as seen here](https://github.com/vuejs/vue-cli/issues/7054)) began to notice that the [node-ipc](https://github.com/RIAEvangelist/node-ipc) dependency was doing some _unusual_ (to put it mildly) things, such as (originally) [corrupting files](https://github.com/RIAEvangelist/node-ipc/issues/319) on systems geolocated to Russia or Belarus, and [sharing messages of protest](https://github.com/RIAEvangelist/node-ipc/issues/233) via `peacenotwar`. This is a complex story, but well outlined in this post, and yet another reminder of how fragile dependencies can be. Liran Tal (Snyk) [![\](https://copm.s3.amazonaws.com/3adc1f91.jpg)](https://frontendmasters.com/courses/fullstack-app-next/?utm_source=nodeweekly&utm_medium=email&utm_content=fullstack) [Build a Fullstack App from Scratch](https://frontendmasters.com/courses/fullstack-app-next/?utm_source=nodeweekly&utm_medium=email&utm_content=fullstack) — Join Scott Moss for this detailed video course on building a fully featured app using a modern stack (React, Next.js, TypeScript, Postgres). You'll cover UI, data modeling, authentication, state management, deployment, testing, and more. Frontend Masters sponsor [Node.js Security Releases Due Imminently](https://nodejs.org/en/blog/vulnerability/mar-2022-security-releases/) — As of the time of publishing, these releases haven’t dropped yet, but they’re imminent and will incorporate upstream patches from OpenSSL for an as yet undisclosed high severity issue. Joe Sepi (Node.js Project) [Faker 6.0: Generate Massive Amounts of Fake Data](https://github.com/faker-js/faker) — After some issues with a maintainer going rogue in January, a community team [took over](https://fakerjs.dev/update.html) the popular Faker project and their first major release is now out, complete with ESM support. There are [v5 to v6 migration instructions](https://fakerjs.dev/migration-guide-v5/) if you want to upgrade. Faker.js Team **Quick bits:** - [Node 17.7.1](https://nodejs.org/en/blog/release/v17.7.1/) has been released to fix a regression in `url.resolve()` when working with URLs that contain the `@` (at) symbol. - NodeSource has unveiled a free tier of [their N|Solid SaaS offering](https://nodesource.com/blog/NSolid-SaaS-is-now-free) for folks who want to explore Node.js metrics, process monitoring, etc. - 📆 [DevOps.js](https://devopsjsconf.com/badge/jared_palmer?from=javascriptweekly) is a virtual conference on building, deploying, and monitoring JS apps taking place next week (March 24-25). [You can register here](https://devopsjsconf.com/badge/jared_palmer?from=javascriptweekly). 💻 Jobs [Senior Backend Developer](https://bitovi.applytojob.com/apply/ddJgMjxN3C/Backend-Nodejs-Developer-Consultant-Remote-Full-Time?source=nodewkly) — Are you looking to level up your skills and work on a wide variety of applications and technologies? Look no further. Bitovi [Senior Node Engineer for Global Health (Remote)](https://systemone.hire.trakstar.com/jobs/fk0sepu?source=cooperpress) — SystemOne's IoT platform enables infectious disease laboratories to securely transport patient data to where it can be actioned. SystemOne [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired [Why and How to Use HTTPS in Your Local Development Environment](https://auth0.com/blog/using-https-in-your-development-environment/) — Learn why you should use HTTPS even for development and how to set things up, including spinning up a simple Node.js server. Andrea Chiarelli [Updating Node Dependencies Automatically, Selectively, or Incrementally](https://elijahmanor.com/byte/update-node-deps) — A tour of [npm-check-updates](https://www.npmjs.com/package/npm-check-updates). Elijah Manor [How to Build a File Upload Service with Vanilla JavaScript](https://blog.logrocket.com/how-to-build-file-upload-service-vanilla-javascript/) — Building a file upload service with vanilla JavaScript, from scratch, with a method that requires _no_ npm packages and _no_ dependencies outside of the standard library. Pankaj Tanwar [Write Your Real-Time Apps in Python with This Tutorial for InfluxDB](https://www.influxdata.com/blog/start-python-influxdb/?utm_source=vendor&utm_medium=referral&utm_campaign=2022-03-16_spnsr-nl_getting-started-python-influxdb_global&utm_content=nodeweekly) InfluxData sponsor ▶[How Remix Helps Bridge the Network Chasm](https://changelog.com/jsparty/215) — Kent C. Dodds—the Director of Developer Experience at Remix—and the JS Party panelists take a look at the new React framework: what it does today, how it lured Kent away from a lucrative independent teaching career and what’s next. The JS Party Podcast podcast [How to Avoid SQL Injection Attacks in Node](https://planetscale.com/blog/how-to-prevent-sql-injection-attacks-in-node-js) James Q Quick [Boost Your Webmaster Skills with the Google Search Console API from Node](https://fusebit.io/blog/google-search-console-nodejs/) Shehzad Akbar [Lessons Learned From Switching to AWS SDK v3 in Node.js Lambda Functions](https://www.readysetcloud.io/blog/allen.helton/lessons-learned-from-switching-to-aws-sdk-v3/) Allen Helton 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/qaublmpmfkvl3rer58fl.jpg)](https://github.com/getgauge/taiko) [Taiko: A Library and REPL to Automate Browsers](https://github.com/getgauge/taiko) — This differs from Puppeteer or Playwright by being higher level and more visual. It includes a REPL mode and is more designed to work with a visible, rather than headless, browser instance, with a bigger focus on testing. Gauge [Pino 7.9.0: A Fast 'Very Low Overhead' JSON Logger](https://github.com/pinojs/pino) — There are code samples for using it with Fastify, Express, Hapi, Koa, and more. pino [Build Internal Tools in Minutes with Retool, Where Visual Programming Meets the Power of Real Code](https://retool.com/?utm_source=sponsor&utm_medium=newsletter&utm_campaign=nodeweekly) Retool sponsor [node-json-db: A Simple JSON-Powered File-Based Data Store](https://github.com/Belphemur/node-json-db) — For when you need a simple database but.. you don’t want a ‘database’, if you know what I mean. Antoine Aflalo [Mongoosastic 5.0: Index Mongoose Models into Elasticsearch Automatically](https://github.com/mongoosastic/mongoosastic) — Now that’s quite the project name. James R. Carr [Awilix 7.0: An Inversion of Control (IoC) Container for Node](https://github.com/jeffijoe/awilix) Jeff Hansen [Hexo 6.1: A Node-Powered SSG-Style Blog Framework](https://hexo.io/) Tommy Chen **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)