--- title: "The one with the npm security stories" publication: "Node Weekly" issue: 437 published_at: "2022-05-12" canonical_url: "https://nodeweekly.com/issues/437" --- Plus a NodeConf EU update, Jest joins OpenJS, and an easy way to build your own GraphQL server. | 🇺🇦 #​437 — May 12, 2022 [Read on the Web](https://nodeweekly.com/issues/437) Node Weekly [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/qrsklvqj3mjnbryxv2ax.jpg)](https://github.blog/2022-05-10-enhanced-2fa-experience-for-your-npm-account/) [An Enhanced 2FA Experience for Your `npm` Account](https://github.blog/2022-05-10-enhanced-2fa-experience-for-your-npm-account/) — Over the past six months, GitHub has been keen to tighten up security around the publishing of `npm` packages with two-factor authentication at the heart of the effort. Now an array of improved 2FA features are in public beta for you to try out, but all maintainers of the top 500 npm packages will be enrolled in a mandatory fashion on May 31. Myles Borins (GitHub) [A Community Group for Web-Interoperable JavaScript Runtimes](https://blog.cloudflare.com/introducing-the-wintercg/) — Cloudflare, Vercel, Shopify and core contributors to Node and Deno have got together to form a new group around the interoperability and development of standardized Web APIs for non-browser, JavaScript-based environments. So much as browsers collaborate on features, so too can backend platforms. James M Snell [![\](https://copm.s3.amazonaws.com/9f966c27.jpg)](https://www.couchbase.com/products/capella/get-started?utm_source=cooperpress_node_weekly&utm_medium=newsletter) [Couchbase Capella DBaaS: Store in JSON, access with SQL](https://www.couchbase.com/products/capella/get-started?utm_source=cooperpress_node_weekly&utm_medium=newsletter) — Build faster with in-memory performance, automatic replication and scaling. Try it now for free and be live in under 3 minutes. Couchbase sponsor [Ryan Dahl on JavaScript Containers](https://tinyclouds.org/javascript_containers) — Ryan, originally known for Node and now [Deno](https://deno.land/), thinks about JavaScript as being a universal scripting language and how the JS sandbox acts as a sort of high level version of the traditional Linux container and will only become more important in the next few years. Ryan Dahl [Mystery of Industry-Focused Backdoored npm Packages Solved](https://www.theregister.com/2022/05/12/npm-attacks-code-white-jfrog/) — Snyk, JFrog and ReversingLabs spent a fair bit of time investigating modules that were built by [an intern at a security research company](https://twitter.com/codewhitesec/status/1524016955186982912) researching dependency confusion. The Register **Quick bytes:** - 📅 [NodeConf EU](https://www.nodeconfremote.com/) is taking place this October 3-5 in Ireland. There's a [call for speakers](https://sessionize.com/nodeconf-eu-2022) open until July 6 if you want to speak. - The popular [Jest](https://jestjs.io/) JavaScript testing framework is [joining the OpenJS Foundation.](https://engineering.fb.com/2022/05/11/open-source/jest-openjs-foundation/) - A common reason for new Node releases is the discovery of vulnerabilities in key dependencies like OpenSSL or (rarely) V8. OpenSSL has a new _low_ severity one explained [in this post by Rafael Gonzaga](https://nodejs.org/en/blog/vulnerability/openssl-fixes-in-regular-releases-may2022/) but it's not significant enough to trigger new Node releases at this time. - [Node 16 LTS](https://vercel.com/changelog/node-js-16-lts-is-now-available) is now available on Vercel. Official AWS Lambda support is also [just around the corner..](https://github.com/aws/aws-lambda-base-images/issues/14#issuecomment-1121436293) - If you're wondering why 2FA is a big deal for npm, well.. [buying expired domains to take over popular packages](https://www.theregister.com/2022/05/10/security_npm_email/) is a thing. [What's Involved in Running a Ransomware Attack in a Node Module](https://charliegerard.dev/blog/ransomware-script-node-module/) — What began as a learning experiment to see how difficult it would be turned into concern at how easy it was.. Charlie Gerard [Keep Up with the Latest in Startups, Tech, & Programming in Just 5 Min](https://tldr.tech/signup?utm_source=nw0512) TLDR Newsletter sponsor [How We Employed The New ES Module Support in TypeScript](https://yonatankra.com/how-to-use-the-new-ecmascript-module-in-typescript/) Yonatan Kra [How to Use the GitHub Pulls API to Manage Pull Requests](https://fusebit.io/blog/github-pulls-api-manage-prs/) Carlos Schults [Managing OAuth 2.0 User Credentials in Your Node App](https://fusebit.io/blog/manage-oauth-user-creds/) Shehzad Akbar 🛠 Code & Tools [GraphQL Yoga 2.0: A Light But Fully-Featured GraphQL Server](https://www.the-guild.dev/blog/announcing-graphql-yoga-v2) — Bills itself as the ‘easiest way to run a GraphQL server’. Yoga follows the GraphQL over HTTP spec, supports file uploaded, subscriptions over HTTP Server Sent Events, and more – plus it’ll work on Node, Deno, or even serverlessly. [GitHub repo.](https://github.com/dotansimha/graphql-yoga) Michał Tyszkiewicz [URL State Machine: A Fast Spec-Compliant URL State Machine](https://github.com/anonrig/url-js) — Aims to follow the [WhatWG spec](https://url.spec.whatwg.org/#url-parsing) on the matter. Yagiz Nizipli [Agenda 4.3: Lightweight Job Scheduling for Node](https://github.com/agenda/agenda) — Uses a MongoDB-backed persistence layer and offers rate limiting, pause/resume, and repeatable jobs. Ryan Schmukler [Data-Driven Edge Functions with Netlify and Polyscale.ai](https://www.polyscale.ai/blog/data-driven-edge-functions-with-netlify-and-polyscale/) PolyScale.ai sponsor [nve 15.0: Run Things With a Specific Node.js Version](https://github.com/ehmicky/nve) — Easily execute a file, command, or REPL using a specific version (or multiple versions) of Node. For example, you could run `npm test` over multiple versions at once. ehmicky [Kafka.js 2.0: A Modern Apache Kafka Client](https://github.com/tulios/kafkajs) — Production ready and supports Kafka 0.10+. _([Kafka](https://kafka.apache.org/) is a popular open source system for working with stream-processing at scale.)_ As the first major release in 4 years, there’s [a migration guide](https://kafka.js.org/docs/migration-guide-v2.0.0) for existing users. Túlio Ornelas [The Official MongoDB Node.js Driver v4.6.0](https://github.com/mongodb/node-mongodb-native/releases/tag/v4.6.0) — You can now define your own custom type for the top level document returned in a `change` event. MongoDB Inc. [Hexo 6.2: A Fast and Simple Node.js Blog Framework](https://github.com/hexojs/hexo) Hexo 💻 Jobs [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired **Got a new email?** You can [change your address here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Bored of us?** [Click here to stop getting Node Weekly](https://nodeweekly.com/leave/*|UID|*). --- **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. Thanks! --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)