--- title: "Playing in the sandbox" publication: "Node Weekly" issue: 476 published_at: "2023-03-02" canonical_url: "https://nodeweekly.com/issues/476" --- Plus another npm supply chain attack, an Express.js boilerplate app, and mitigating cold start delays. | #​476 — March 2, 2023 [Read on the Web](https://nodeweekly.com/issues/476) Together with [![Memetria\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_600,h_145/e_make_transparent/co_white,e_outline:7/vvpdctzacmq3xehpvwps.png)](https://dashboard.memetria.com/nodeweekly) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/bblhcvx6h1tp7r9eqqea.jpg)](https://github.com/google/zx) [zx 7.2: A Tool for Writing Better Shell Scripts](https://github.com/google/zx) — Always a popular tool when we link it! `zx` is an alternative way to run Node that makes it more useful for shell scripting by bringing along a variety of niceties like process management, argument handling, and including useful packages like [Chalk](https://github.com/chalk/chalk) for text coloring. [v7.2](https://github.com/google/zx/releases/tag/7.2.0) adds `retry` and `spinner` helpers (for retrying callbacks and showing a spinner UI element, respectively). Google [Node.js Toolbox: A New Way to Find Node.js Packages](https://nodejstoolbox.com/) — If you’ve worked in the Ruby/Rails space, you might know [Ruby Toolbox](https://www.ruby-toolbox.com/) as a long-time way to find and compare libraries. It’s _early days_ but Node.js Toolbox is an unrelated, but similar effort curating Node packages in areas like [HTTP frameworks](https://nodejstoolbox.com/categories/http-frameworks), [browser testing](https://nodejstoolbox.com/categories/browser-testing) and [query builders](https://nodejstoolbox.com/categories/query-builders). Maxim Orlov [![\](https://copm.s3.amazonaws.com/b5f068cf.png)](https://dashboard.memetria.com/nodeweekly) [Memetria: Secure, Scalable, Full-Featured Redis 7 Hosting](https://dashboard.memetria.com/nodeweekly) — The latest Redis features, instrumented and scaled with the tools teams need as they grow. Memetria sponsor [Sandbox Security Concerns with Node's `vm` Module](https://snyk.io/blog/security-concerns-javascript-sandbox-node-js-vm-module/) — [node:vm](https://nodejs.org/api/vm.html) lets you compile and run code within separate contexts of the underlying V8 engine. Great for sandboxing, right? Not so fast. Even the docs say it’s _not_ for running untrusted code. Liran looks at the implications. Liran Tal **IN BRIEF:** - Yet again, npm supply chain security issues have reared their head with a supposed [flood of 15,000 phishing packages](https://www.scmagazine.com/analysis/devops/npm-repository-15000-phishing-packages) on February 20/21. - You can now [add pronouns to your GitHub profile](https://github.blog/changelog/2023-03-01-add-pronouns-to-your-github-profile/). - [Strapi](https://github.com/strapi/strapi) is an open source Node.js-based headless CMS but the company behind it has unveiled [Strapi Cloud](https://strapi.io/blog/strapi-cloud-is-now-available), a commercial option for running it in the cloud. [Experiments in Mitigating Serverless Cold Start Delays](https://punits.dev/blog/mitigating-serverless-cold-start-delays/) — If you’re using Node for serverless functions on Vercel or Netlify, is a ‘cold start’ delay still a thing, and would frequently pinging a function mitigate against it? Due to how Vercel and Netlify specifically work, those pings may not be as useful as you'd suspect.. Punit Sethi [Sandboxing JavaScript Code](https://healeycodes.com/sandboxing-javascript-code) — [Val Town](https://www.val.town/) is an interesting, rather minimalist platform for running JavaScript in the cloud, and if you’re going to let folks run JavaScript on _your_ server, good sandboxing is a must – they use Node and [vm2](https://github.com/patriksimek/vm2) (well, [for now anyway.](https://blog.val.town/blog/val-town-newsletter-3#2bcad60775d141e9a3e5c72f31a0d168)) Andrew’s route to V8 sandboxing bliss, however, was Deno rather than Node, as he demonstrates here. Andrew Healey [Bitmovin Handbook - The Definitive Guide to Video Codecs](https://go.bitmovin.com/video-codec-guide?utm_source=cooper-press&utm_medium=node-weekly-sponsored-link&utm_campaign=whitepaper&utm_content=mini-guide-codecs) — A quick overview into the history and application of the most used codecs to help you select the ideal codec application. Bitmovin Inc. sponsor ▶[A Deep Dive into the Node.js Event Loop](https://www.youtube.com/watch?v=KKM_4-uQpow) Tyler Hawkins 🛠 Code & Tools [Remult: A CRUD Framework for Full-Stack TypeScript](https://remult.dev/) — Promises a ‘zero-boilerplate’ CRUD API experience by using your TypeScript entities as a single source of truth for your API, frontend type-safe API client _and_ backend ORM. There are [tutorials](https://github.com/remult/remult#getting-started) for using it alongside React, Angular, Vue and Next.js. Remult Team [BullMQ 3.9: Reliable, Redis-Based Distributed Queue for Node](https://github.com/taskforcesh/bullmq) — A fast, reliable Redis-based distributed queue for Node with a focus on stability and atomicity. Taskforce.sh Inc. [Need to Upgrade to Node 18? Don’t Have Time? Our Experts Can Help 🚀](https://www.upgradejs.com?utm_source=cooperpress&utm_medium=node-weekly&utm_campaign=node-wk-mar-2-2023&utm_term=node&utm_content=upgrade-node-18) UpgradeJS.com: JavaScript Upgrade Services sponsor [A Boilerplate Express.js + MongoDB Node.js App](https://github.com/watscho/express-mongodb-rest-api-boilerplate) — ‘express-mongodb-rest-api-boilerplate’ doesn’t really roll off the tongue, but there’s a lot baked in here. watscho [Official MongoDB Node.js Driver 5.1](https://github.com/mongodb/node-mongodb-native/releases/tag/v5.1.0) — The official MongoDB driver now supports [BigInt values](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/BigInt) with automatic serialization to BSON longs and vice versa. MongoDB, Inc. [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/zkoujkxdpg6q0ujhppua.jpg)](https://github.com/eta-dev/eta) - ↑ [eta (η) 2.0.1](https://github.com/eta-dev/eta) ↳ Embedded template engine for Node, Deno & browser. - [Restify 11.1](https://github.com/restify/node-restify) ↳ Middleware-driven REST API framework. - [csvToJson 2.0](https://github.com/iuccio/csvToJson) ↳ Convert CSV files to JSON with Node. - [mojo.js 1.23](https://github.com/mojolicious/mojo.js) ↳ Real-time web framework for Node. _(Their [example](https://github.com/mojolicious/mojo.js#duct-tape-for-the-web) of how easily you can spin up a WebSocket system is pretty neat.)_ - [Slonik 33.1](https://github.com/gajus/slonik) ↳ Type-safe Postgres client library. - [pnpm 7.28](https://github.com/pnpm/pnpm) ↳ Alternative, efficient package manager. 💻 Jobs [Software Engineer (Backend)](https://jobs.ashbyhq.com/stickermule/477eed3e-4aae-46e6-a8ab-0646dbfb11cd?utm_source=Cooperpress) — Join our "kick ass" team. Our software team operates from 17 countries and we're always looking for more exceptional engineers. Sticker Mule [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=easy-job-hunting) — Hired makes job hunting easy-instead of chasing recruiters, companies approach you with salary details up front. Create a free profile now. Hired **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address.](https://nodeweekly.com/edit_subscription/*|UID|*)