---
title: "A big supply chain attack on the npm ecosystem"
publication: "Node Weekly"
issue: 592
published_at: "2025-09-09"
canonical_url: "https://nodeweekly.com/issues/592"
---

Plus how a developer handled 500 million clicks with Node and a $4 VPS. |        

#​592 — September 9, 2025 

[Read on the Web](https://nodeweekly.com/issues/592)  

Together with [![Code Rabbit\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,e_trim,w_1238,h_192/e_make_transparent/co_white,e_outline:37/fcshbu9d17nd8smej96j.png)](https://coderabbit.link/GAJouVh)  

![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) 

[![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/kzdihezwybmfv4v41ktk.jpg)](https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack)  

[A Major Supply Chain Attack Hits the npm Ecosystem](https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack) — In July, Socket warned us about [a phishing campaign](https://socket.dev/blog/npm-phishing-email-targets-developers-with-typosquatted-domain) targeting npm package publishers. Sadly, a prolific package author (among [others](https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack), like [DuckDB, who explain how the attack worked on them](https://github.com/duckdb/duckdb-node/security/advisories/GHSA-w62p-hx95-gf2c)) [fell victim](https://bsky.app/profile/bad-at-computer.bsky.social/post/3lydioq5swk2y) to the scam, resulting in some popular packages becoming compromised ([like Chalk](https://github.com/chalk/chalk/issues/656), [debug](https://social.hackerspace.pl/@informatic/115168929981581855), and [others](https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised)). 

Gooding, Brown, et al. (Socket)   

💡 Inspired by the above story, [Zbyszek Tenerowicz shows off an interesting tool](https://github.com/naugtur/running-qix-malware) / Webpack plugin (that he works on) called [LavaMoat](https://github.com/LavaMoat/LavaMoat) that can be used to sandbox / contain dependencies that are only made available [by way of defined policies.](https://lavamoat.github.io/guides/policy/)  [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/6e3b2159.png)](https://coderabbit.link/GAJouVh) 

[CodeRabbit’s Free AI Code Reviews in IDE - VS Code, Cursor, Windsurf](https://coderabbit.link/GAJouVh) — Code Rabbit brings AI code reviews to VS Code, Cursor & Windsurf. Get line-by-line reviews, one-click fixes & codebase-aware feedback - all free in your IDE. Seamlessly integrates with git workflows. [Install the extension & start reviewing!](https://coderabbit.link/GAJouVh) 

CodeRabbit sponsor   

[Bringing Node HTTP Servers to _Cloudflare Workers_](https://blog.cloudflare.com/bringing-node-js-http-servers-to-cloudflare-workers/) — A few weeks ago [we linked to an item](https://jross.me/run-express-js-on-cloudflare-workers/) that noticed Cloudflare Workers' local dev tools had begun to support Express.js apps – now support has come to _Workers_ proper, with support for `node:http`’s client and server APIs if you enable [Node.js compatibility.](https://developers.cloudflare.com/workers/runtime-apis/nodejs/) 

Nizipli and Snell (Cloudflare)   

**IN BRIEF:** 

- [Vercel now supports](https://vercel.com/changelog/zero-configuration-express-backends) Express-based backends with zero configuration, and Vercel Functions running on Node now also [support graceful shutdowns](https://vercel.com/changelog/vercel-functions-now-support-graceful-shutdown), giving you 500ms to run cleanup tasks before termination.
- 📗 [NodeBook](https://www.thenodebook.com/) is a new, in-progress book promising a 'deep dive' into Node's internals, and it already delivers [a look inside the V8 JavaScript engine](https://www.thenodebook.com/node-arch/v8-engine-intro) and [how Node's event loop works.](https://www.thenodebook.com/node-arch/event-loop-intro)
- On X, [Marco Ippolito laments that Node.js lives in a paradox](https://x.com/satanacchio/status/1965072308789514255) of progressing both "too fast" and "too slow" for many developers.   

[Node.js v20.19.5 (LTS) Released](https://nodejs.org/en/blog/release/v20.19.5) — A quiet release dominated by bugfixes and a large number of dependency updates. It arrived quickly after [v22.19.0 (LTS)](https://nodejs.org/en/blog/release/v22.19.0), which unflagged `--experimental-wasm-modules`, added `server.keepAliveTimeoutBuffer` to `http`, and added the ability for Node to use the system’s certificate authority (CA) via the `NODE_USE_SYSTEM_CA` environment variable. 

Marco Ippolito   

📄 [Getting Accurate Text Lengths with `Intl.Segmenter`](https://blog.sangeeth.dev/posts/accurate-text-lengths-with-intl-segmenter-api/) – A useful tip for when `str.length` isn’t returning what you’d quite expect.. Sangeeth Sudheer 

📺 [Handling 500 Million Clicks with a $4 VPS](https://www.youtube.com/watch?v=nk3Ti0tCGvA) – A developer goes behind the scenes of his Node.js-backed site that went viral. Andrew Schmelyun 

📄 [Why I Ditched Docker for Podman (And You Should Too)](https://codesmash.dev/why-i-ditched-docker-for-podman-and-you-should-too) Dominik Szymański 

📄 [UDP in Node.js: A Technical Guide](https://nodevibe.substack.com/p/udp-in-nodejs-deep-technical-guide) Pavel Romanov    

🛠 Code & Tools  

[Mediabunny: A Complete Media Toolkit for JavaScript](https://mediabunny.dev/) — A library to read, write and convert popular media file formats (e.g. MP4, MP3, [and more](https://mediabunny.dev/guide/supported-formats-and-codecs)) without leaning on dependencies like FFmpeg. You can [make thumbnails](https://mediabunny.dev/examples/thumbnail-generation/), [extract metadata](https://mediabunny.dev/examples/metadata-extraction/), [write code that gets converted into a video](https://mediabunny.dev/examples/procedural-generation/), and more. [GitHub repo.](https://github.com/Vanilagy/mediabunny) 

Vanilagy   

[Rocketadmin: An Efficient and Secure No-Code Back Office Solution](https://rocketadmin.com/?utm_source=nodeweekly) — Save time and make things easier for your users with a powerful, feature-rich admin panel. We support all main databases. 

Rocketadmin sponsor   

[sqs-consumer 13.0: Build Amazon SQS-Based Apps Without Boilerplate](https://github.com/bbc/sqs-consumer) — Build SQS-based (Simple Queue Service) apps without the boilerplate. Just define an async function to handle the SQS message processing. If it’s good enough for the BBC.. 

BBC   

[github-script 8.0: Script the GitHub API in _Actions_ Workflows](https://github.com/actions/github-script) — If you want to write GitHub Actions that perform operations via the GitHub API using JavaScript, this is for you. Now supports Node.js 24. 

GitHub Actions   

- [serverless-http 4.0](https://github.com/dougmoscrop/serverless-http) – Use your existing middleware framework (e.g. Express, Koa) on AWS Lambda.
- [express-openapi-validator 5.6](https://github.com/cdimascio/express-openapi-validator) – Auto-validate API requests and responses in Express against an OpenAPI 3.x spec.
- [Prisma 6.15](https://github.com/prisma/prisma/releases/tag/6.15.0) – The popular ORM for Node.js and TypeScript gains some 'AI safety guardrails.'
- [Tinypool 2.0](https://github.com/tinylibs/tinypool) – Minimal Node.js worker thread pool implementation.
- [Sidequest 1.7](https://github.com/sidequestjs/sidequest) – Scalable background job processor for Node apps.
- [MongoDB Node.js Driver 6.19](https://github.com/mongodb/node-mongodb-native/releases/tag/v6.19.0) – The latest official MongoDB driver.
- [Electron 38.0](https://github.com/electron/electron) – The cross-platform desktop app framework.
- [express-rate-limit 8.1](https://github.com/express-rate-limit/express-rate-limit) – Basic rate limiting for Express apps.
- [Fastify 5.6](https://github.com/fastify/fastify/releases/tag/v5.6.0) – The fast, low overhead Node web framework.
- [JSPyBridge 1.2.5](https://github.com/extremeheat/JSPyBridge) – Run Python from Node or vice versa.
- [NodeBB 4.5](https://github.com/NodeBB/NodeBB/releases/tag/v4.5.0) – The Node.js-powered forum system.
- [ESLint v9.35.0](https://eslint.org/blog/2025/09/eslint-v9.35.0-released/)       

📰 Classifieds    

Master Node API design with ▶️ [this video course](https://frontendmasters.com/courses/api-design-nodejs-v4/?utm_source=email&utm_medium=nodeweekly&utm_content=nodejsv4). Learn API anatomy, auth, testing, deployment, and more. New members [get $100 off](https://frontendmasters.com/sale/?utm_source=email&utm_medium=nodeweekly&utm_content=sale) a yearly membership. 

--- 

Go beyond caching. [Redis 8.2](https://redis.io/lp/get-started2/?utm_source=cooper-press&utm_medium=cpa&utm_campaign=2025-08-app_performance-node-weekly-2&utm_content=cloud_-_redis_cloud_users) handles 5x more data with 150 new commands and 8 new data structures vs 7.2. [Try Redis Pro—first $200 free](https://redis.io/lp/get-started2/?utm_source=cooper-press&utm_medium=cpa&utm_campaign=2025-08-app_performance-node-weekly-2&utm_content=cloud_-_redis_cloud_users%20).    

📢 Elsewhere in the ecosystem  

A roundup of some other interesting stories in the broader landscape: 

- [Learn about why browsers throttle JavaScript timers](https://nolanlawson.com/2025/08/31/why-do-browsers-throttle-javascript-timers/) with Nolan Lawson, and learn about some techniques to schedule functions to run_ASAP_.
- [Andromeda](https://tryandromeda.dev/) is the newest JavaScript runtime on the block, powered by the [Nova](https://trynova.dev/) engine. It's built in Rust and boasts direct GPU accelerated graphics support, single file compilation, and memory safety.
- 🗓️ Thoughtbot shares [a list of upcoming JavaScript conferences](https://thoughtbot.com/blog/upcoming-javascript-and-react-conferences-for-2025) taking place over the remainder of 2025.
- [`Intl` Playground](https://intlin.site/) is a handy site to get a quick look at how the different options on `Intl.DateTimeFormat` present in real life.
- Deno's [Fresh](https://fresh.deno.dev/) framework is [now out in _Fresh 2.0 Beta_ form.](https://deno.com/blog/fresh-and-vite) It can now optionally run as a Vite plugin which opens up numerous new possibilities.
- TIL the MacBook Pro has a 'lid angle sensor' [that can be programatically queried.](https://github.com/samhenrigold/LidAngleSensor) A [video on X](https://x.com/samhenrigold/status/1964428927159382261) shows off the feature with a comedic effect.    

**Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ 

--- 

**Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. 

--- 

Published by Cooper Press Ltd.
Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom 

[Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).