--- title: "A collection of proficient Node.js dev practices" publication: "Node Weekly" issue: 430 published_at: "2022-03-24" canonical_url: "https://nodeweekly.com/issues/430" --- Plus more npm supply chain problems, and would you like a Chinese name? | 🇺🇦 #​430 — March 24, 2022 [Read on the Web](https://nodeweekly.com/issues/430) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/mk4qoxymndatnjbbvzdv.jpg)](https://alexkondov.com/tao-of-node/) [Tao of Node: On Design, Architecture and Best Practices](https://alexkondov.com/tao-of-node/) — A developer has boiled down all of the hard-earned best practices and gut feelings he’s picked up for developing high-quality Node apps over time. Opinionated, yes, but high level enough to provide value to most. Alex Kondov [Node v17.8.0 (Current) Released](https://nodejs.org/en/blog/release/v17.8.0/) — A relatively minor update: npm upgraded to v8.5.5, an update to the [Undici](https://github.com/nodejs/undici) HTTP/1.1 client, and [you can now trace requests made by `http`](https://nodejs.org/api/perf_hooks.html#measuring-how-long-one-http-round-trip-takes) using `perf_hooks` to accurately measure round-trip time, etc. Bryan English [![\](https://copm.s3.amazonaws.com/9b72307f.png)](https://userfront.com/tutorials/react-authentication.html) [React Authentication, Simplified](https://userfront.com/tutorials/react-authentication.html) — In this article, we lay out a new approach to authentication (plus access control & SSO) in React applications. Userfront sponsor [Malicious npm Packages Targeting Azure Developers](https://jfrog.com/blog/large-scale-npm-attack-targets-azure-developers-with-malicious-packages/) — No, this isn’t a repeat of [last week’s](https://nodeweekly.com/issues/429) tale of npm supply chain woes, but a discovery of _“hundreds of malicious packages designed to steal PII”_ targeting developers using packages under the `@azure` scope. Polkovnychenko and Menashe (JFrog) [Node.js Security Releases to Fix High Severity OpenSSL Bug](https://nodejs.org/en/blog/vulnerability/mar-2022-security-releases/) — Last week they were imminent, but now they’re here in the form of [Node 12.22.11 (LTS)](https://nodejs.org/en/blog/release/v12.22.11/), [14.19.1 (LTS)](https://nodejs.org/en/blog/release/v14.19.1/), [16.14.2 (LTS)](https://nodejs.org/en/blog/release/v16.14.2/) and [17.7.2 (Current)](https://nodejs.org/en/blog/release/v17.7.2/) (though ignore the latter if you go for 17.8.0 above). The fix? [An OpenSSL bug](https://www.openssl.org/news/secadv/20220315.txt) that could cause an infinite loop when parsing certain invalid certificates. Joe Sepi (Node.js Project) 💻 Jobs [Senior Backend Developer](https://bitovi.applytojob.com/apply/ddJgMjxN3C/Backend-Nodejs-Developer-Consultant-Remote-Full-Time?source=nodewkly) — Are you looking to level up your skills and work on a wide variety of applications and technologies? Look no further. Bitovi [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired [AWS Graviton2 vs Apple M1 for Node.js Performance](https://spacedoutandsmiling.com/blog/2021-12-27-nerdy-aws-graviton-vs-m1-vs-m1-pro-nodejsr-benchmarks) — A casual and personal benchmark, with all that implies, and while the M1 continues to impress for local development, it’s neat to see other production grade ARM-based systems ready to go too. Jamie Knight [How to Manage Sessions using Passport, Redis, and MySQL](https://arctype.com/blog/node-session/) — A practical walkthrough of creating a simple Express app with user credentials stored in MySQL, sessions in Redis, and Passport tying it all together. A commonly used pattern boiled down to the essentials. Clara Ekekenta [10 Best Practices to Containerize Node.js Web Applications with Docker](https://snyk.io/blog/10-best-practices-to-containerize-nodejs-web-applications-with-docker/?utm_campaign=AOM-UA-2022&utm_medium=Paid-Email&utm_source=Cooperpress-Node-Weekly&utm_content=10-best-practices-to-containerize-nodejs-web-applications-with-docker) Snyk sponsor ▶[What's Really Going on Inside Your `node_modules` Folder: The Video](https://youtu.be/-uAX28hfZcc) — Two weeks ago, we featured [an extensive written alternative](https://socket.dev/blog/inside-node-modules) to this half-hour talk that dives into examples of recent supply chain attacks and some concrete steps you can take to protect your team from this emerging threat – but if you prefer talks/videos, this is well worth the time :-) Feross Aboukhadijeh [Authorization in a Microservices World](https://www.alexanderlolis.com/authorization-in-a-microservices-world) — Thinking through from a simple approach to full-on attribute-based access control. Not Node specific though the final example is Express-based. Alexander Lolis 🛠 Code & Tools [Dum: An `npm` Script Runner Written in Rust](https://github.com/egoist/dum) — Continuing a trend of building JavaScript tools in, well, _not_ JavaScript, the curiously named ‘Dum’ aims to replace `npm run` and `npx` to shave milliseconds off the task startup time. YMMV.. EGOIST [Video to Reels: Automatically Edit Videos to Post on Instagram Reels](https://github.com/diego3g/video-to-reels) — Powered by FFmpeg, ImageMagick, and zx. Features include rotate, resize, add a color filter, normalize audio, and more. Diego Fernandes [Metered Video: Developer First Video Calling API/SDK for Web & Mobile](https://www.metered.ca/) Metered Video sponsor [Chrome Extension CLI: CLI for Building Chrome Extensions](https://github.com/dutiyesh/chrome-extension-cli) — Want to get building an extension for Chrome as quickly as possible? This Node-powered tool aims to get you on the right path ASAP. Dutiyesh Salunkhe [Directus: Wrap an SQL Database with a Real-Time GraphQL + REST API](https://github.com/directus/directus) — A Node.js-powered open source system that can act as a frontend to Postgres, SQLite, MySQL, Oracle, and other SQL databases, and provide a modern dashboard, client, and both REST and GraphQL APIs. _(Note the GPL license.)_ Directus [Chinese Random Name: Generate Random Chinese Names](https://github.com/XadillaX/chinese-random-name) — There’s surely an npm package for every want or desire. Khaidi Chu [graphql-request 4.2: A Minimal GraphQL Client Library](https://github.com/prisma-labs/graphql-request) Prisma Labs [HyperExpress: High Performance Node Server Powered by uWebSockets.js](https://github.com/kartikk221/hyper-express) Kartik **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)