--- title: "Digging into dependencies with npm query" publication: "Node Weekly" issue: 457 published_at: "2022-10-06" canonical_url: "https://nodeweekly.com/issues/457" --- Plus Axios hits 1.0, packages keep getting typosquatted, and Google's zx gets even better. | #​457 — October 6, 2022 [Read on the Web](https://nodeweekly.com/issues/457) Together with [![Courier logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_280,h_50/e_make_transparent/co_white,e_outline:7/clkuuoftwiz8z2xjnkhb.png)](https://www.courier.com/docs/guides/getting-started/nodejs/?utm_campaign=demand-gen&utm_source=email&utm_medium=node-weekly-primary-10-6&utm_content=guide-node-getting-started) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/pguc6v2wsol9f5ydwchw.jpg)](https://blog.phylum.io/phylum-detects-active-typosquatting-campaign-targeting-npm-developers) [An Active Typosquatting Campaign Targeting npm Users](https://blog.phylum.io/phylum-detects-active-typosquatting-campaign-targeting-npm-developers) — Security supply chain company Phylum detected a campaign to ‘typosquat’ against a variety of high profile packages. The idea behind typosquatting is that you claim package names _similar_ to others, such as ‘expresss’ for `express` or ‘ignroe’ for `ignore`. The discovered packages were removed from the npm registry but this is an issue to keep an eye out for. Louis Lang (Phylum) [Axios 1.0: A Reasonably Popular HTTP Client Library](https://github.com/axios/axios/releases/tag/v1.0.0) — We thought you’d like an understatement.. 😁 With 96k GitHub stars and a presence in many thousands of apps, Axios is _very_ popular and it’s amazing it’s just now reached 1.0. The Fetch API has taken much of its thunder, but like jQuery, it wraps up a lot of functionality into a broadly liked API. v1.0 has lots of minor tweaks and enhancements, but is mostly business as usual. ([Official homepage](https://axios-http.com/).) Axios Project [![\](https://copm.s3.amazonaws.com/494d6eef.jpg)](https://www.courier.com/docs/guides/getting-started/nodejs/?utm_campaign=demand-gen&utm_source=email&utm_medium=node-weekly-primary-10-6&utm_content=guide-node-getting-started) [New Node.js API from a Google Ventures-Backed Notifications Infrastructure Service](https://www.courier.com/docs/guides/getting-started/nodejs/?utm_campaign=demand-gen&utm_source=email&utm_medium=node-weekly-primary-10-6&utm_content=guide-node-getting-started) — Contacting your users should be simple. That’s why we built Courier. With a single request you can contact your users on multiple channels. Even better, you can schedule notifications and route to the best contact method. [Try it today](https://www.courier.com/docs/guides/getting-started/nodejs/?utm_campaign=demand-gen&utm_source=email&utm_medium=node-weekly-primary-10-6&utm_content=guide-node-getting-started%20). Courier.com sponsor ▶[Using `npm query` and `jq` to Dig Into Your Dependencies](https://www.youtube.com/watch?v=h_ZpixOgKDY) — npm 8.18.0 introduced [the ‘npm Dependency Selector Syntax’](https://github.blog/changelog/2022-08-03-introducing-the-new-npm-dependency-selector-syntax/) and the `npm query` to use it to be able to programmatically query a project’s dependencies. In this video, Elijah shows us how and why we’d actually use it. _(5 minutes.)_ Elijah Manor [The New Test Framework Built-In to Node 18.8+ Explained](https://t.co/Cpx1rnxwwY) — We’ve mentioned it a few times, but here’s a bit more of a guided introduction to Node’s new ‘no-dependencies-required’ way to run test suites. David Herron [Announcing TypeScript 4.9 Beta](https://devblogs.microsoft.com/typescript/announcing-typescript-4-9-beta/) — This is a very _'satisfy'-ing_ update that introduces the `satisfies` operator for when you want to validate a type of an expression matches some type but without changing the actual resulting type. The `in` operator also becomes more powerful when narrowing types with unlisted properties. Daniel Rosenwasser (Microsoft) [Best Practices for Creating a Modern npm Package](https://snyk.io/blog/best-practices-create-modern-npm-package/?utm_campaign=AOM-2022&utm_medium=Paid-Email&utm_source=Cooperpress-Node-Weekly&utm_content=best-practices-create-modern-npm-package) — Learn how to create modern and sustainable npm packages using these best practices. [Check it out now](https://snyk.io/blog/best-practices-create-modern-npm-package/?utm_campaign=AOM-2022&utm_medium=Paid-Email&utm_source=Cooperpress-Node-Weekly&utm_content=best-practices-create-modern-npm-package). Snyk sponsor [On Quality Code: Node.js Design Patterns and Performance](https://sprkl.dev/quality-code-node-js-design-patterns-and-performance/) — A written transcript of an interview with Luciano Mammino, the author of _Node.js Design Patterns_, covering all sorts of areas from serverless architecture to design patterns and streams. Raz Cohen (Sprkl) [Ten Best Practices to Containerize Node Apps with Docker](https://snyk.io/blog/10-best-practices-to-containerize-nodejs-web-applications-with-docker/) — Production-grade guidelines for building optimized and secure Node-based Docker images whether for microservices, server-side rendering, or stand alone apps. Now with a [fresh PDF cheatsheet](https://snyk.io/wp-content/uploads/NodeJS-CheatSheet.pdf). Liran Tal and Yoni Goldberg [Routing Postgres Queries Between Read-Write and Read-Only Instances](https://contra.com/p/3oqY62QO-routing-postgresgl-queries-between-read-write-read-only-instances) Gajus Kuizinas [Hosting a Ghost 5 Site on Fly.io's Free Tier in Two Minutes](https://www.autodidacts.io/host-ghost-mysql8-on-fly-io-free-tier/) Curiositry 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/bmpmvws3g1gnnib9s7p0.jpg)](https://github.com/google/zx/releases/tag/7.1.0) [zx 7.1: Google's Tool for Easier Scripting with Node.js](https://github.com/google/zx/releases/tag/7.1.0) — The idea is simple: use JavaScript instead of bash or similar shell scripting. zx smoothes off the rough edges (see [the README](https://github.com/google/zx#-zx) for examples). v7.1 introduces a new `--install` option that will detect and install all required/imported packages for a script making it even easier to use. Google [Serverless-Postgres 2.0: Manage Postgres Connections at Serverless Scale](https://github.com/MatteoGioioso/serverless-pg) — An interesting alternative to proxying large numbers connections to Postgres that, as long as you’re using a library built on top of `node-pg`, keeps things organized from your app itself. Matteo Gioioso [Get Real-Time Tracking and Monitoring for All of Your Tests](http://buildkite.com/test-analytics?utm_campaign=CPress&utm_source=ppc&utm_medium=Q4-NodeWeekly&utm_term=Test-Analytics) Buildkite Test Analytics sponsor [Sharing 1.0: Tool to Share Directories with iOS / Android Devices](https://github.com/parvardegr/sharing) — Basically a simple file server that spits out a QR code you can scan to access files from your mobile devices on the same network. parvardegr - [Middy 3.5](https://github.com/middyjs/middy) ↳ Middleware engine for AWS Lambda. - [Fastify 4.7](https://github.com/fastify/fastify) ↳ Fast, low overhead web framework. - [SuperTest 6.3](https://github.com/visionmedia/supertest) ↳ Super-agent driven Node.js HTTP API testing. - [Ow 1.1](https://github.com/sindresorhus/ow) ↳ Chainable function argument validations. - [nodejs-Google Cloud Speech 5.1](https://github.com/googleapis/nodejs-speech) ↳ Adds Speech v2 API support in advance. - [Sequelize 6.24](https://github.com/sequelize/sequelize) ↳ Node.js ORM for numerous SQL databases. - [Bull 4.10](https://github.com/OptimalBits/bull) ↳ Reliable, Redis-based queue for Node. - [Happy DOM 7.0](https://github.com/capricorn86/happy-dom) ↳ JS implementation of a browser sans UI. - [meilisearch-js 0.28](https://github.com/meilisearch/meilisearch-js) ↳ JavaScript client for the Meilisearch search system. 💻 Jobs [Full Stack Engineer (EU Remote or Relocate to Berlin)](https://feather-insurance.com/careers/full-stack-engineer?channel_id=921907) — We’ve built a product thousands of people love (see Trustpilot if you don’t believe us). We need your help with **React, GraphQL & TypeScript**. Feather [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address.](https://nodeweekly.com/edit_subscription/*|UID|*)