--- title: "Ten top web application security threats" publication: "Node Weekly" issue: 600 published_at: "2025-11-11" canonical_url: "https://nodeweekly.com/issues/600" --- Plus an update on npm security changes and a way to write JavaScript in Japanese. | #​600 — November 11, 2025 [Read on the Web](https://nodeweekly.com/issues/600) Together with [![Tiger Data logo\](https://res.cloudinary.com/cpress/image/upload/c_fill,g_auto,w_1280,h_282/e_make_transparent/co_white,e_outline:30/px1u7kjyvz7xnbm6ytir.png)](https://www.tigerdata.com/blog/postgres-for-agents) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/vrxbuyfqhkgxcvqtoeu8.jpg)](https://nodejs.org/en/learn/getting-started/security-best-practices) [Node.js Security Best Practices](https://nodejs.org/en/learn/getting-started/security-best-practices) — Did you know the Node.js project maintains a page about security best practices organized around how to mitigate ten of the most significant vectors? Topics include networking weaknesses, timing attacks, supply chain attacks, and the monkey patching of intrinsics. Node Documentation 💡 On security, Liran Tal's [Awesome Node.js Security](https://github.com/lirantal/awesome-nodejs-security) is always worth a revisit and includes numerous resources and a timeline of notable security incidents. OWASP has also just released an RC of [its list of the top ten webapp security threats in 2025.](https://owasp.org/Top10/2025/0x00_2025-Introduction/) [![\](https://res.cloudinary.com/cpress/image/upload/c_limit,w_480,h_480,q_auto/copm/d923f0a0.png)](https://www.tigerdata.com/blog/postgres-for-agents) [Agentic Postgres: AI-Ready Postgres for Go Developers](https://www.tigerdata.com/blog/postgres-for-agents) — Tiger Data’s Agentic Postgres turns vanilla Postgres into an AI-native database. Fork DBs, give agents memory, and query via REST or CLI. Perfect for Go backends building with Claude, Cursor, or custom agents. Try it free—no card needed. Tiger Data sponsor [pnpm 10.21: Safer Installs and Smarter Runtime Management](https://pnpm.io/blog/releases/10.21) — pnpm can now automatically install the Node version required by a dependency, declared in its `engines.runtime` field, meaning CLI apps and `postinstall` scripts will run with the specified version. A new `trustPolicy` setting also adds protection against supply-chain attacks by failing to install packages whose trust level drops (e.g. if a package’s build pipeline loses attestation). Zoltan Kochan **IN BRIEF:** - GitHub has updated [its post about ongoing npm security changes](https://github.blog/changelog/2025-11-05-npm-security-update-classic-token-creation-disabled-and-granular-token-changes/). npm classic tokens can no longer be created, but existing ones will continue to work until February 2026 at the latest. - On Reddit's `/r/node`, Jeet Shekhaliya shares [his efforts to create a system to automatically test thousands of popular npm packages](https://www.reddit.com/r/node/comments/1oprhaq/im_testing_npm_libs_against_nodecurrent_daily_so/) against the latest daily build of Node. You can see [the latest report here.](https://github.com/whitestorm007/node-compatibility-dashboard/blob/main/report.md) - Dr. Axel Rauschmayer [noticed](https://bsky.app/profile/dr-axel.de/post/3m5bqgichos2b) a `pnpm` feature we weren't aware of before: [the ability to install and manage different versions of Node.](https://pnpm.io/cli/env) - [Node.js 24 is now available on Azure App Service for Linux.](https://techcommunity.microsoft.com/blog/appsonazureblog/node-js-24-is-now-available-on-azure-app-service-for-linux/4468801) ▶[The State of Node.js 2025 Explained by Matteo Collina](https://www.youtube.com/watch?v=IgSwJaheiGk) — A thirty minute talk from _JSNation_ earlier this year where TSC member Matteo presented an update on Node’s still-growing popularity, release schedule, security, recent performance enhancements, the permissions system, and more. GitNation 📄 [Error Chaining in JS: Cleaner Debugging with `Error` and `cause`](https://allthingssmitty.com/2025/11/10/error-chaining-in-javascript-cleaner-debugging-with-error-cause/) Matt Smith 📄 [Building NestJS Applications Following the CQRS Model](https://www.telerik.com/blogs/building-nestjs-applications-following-the-cqrs-model) Christian Nwamba 📄 [Zod + TypeScript: Schema Validation Made Easy](https://www.telerik.com/blogs/zod-typescript-schema-validation-made-easy) Hassan Djirdeh 🛠 Code & Tools [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/p2b7csuw8eqebbk7r6yz.jpg)](https://github.com/umami-software/umami/releases/tag/v3.0.0) [Umami 3.0: A Self-Hosted, Privacy-Focused Google Analytics Alternative](https://github.com/umami-software/umami/releases/tag/v3.0.0) — Think something like [Plausible](https://github.com/plausible/analytics) or Google Analytics, but built in Node and ready for you to host yourself. Here’s [the full feature list.](https://umami.is/features) MIT licensed but also available as [a paid hosted service.](https://umami.is/) Umami Software, Inc. [Unify Logs, Errors, and Traces in One Place](https://sentry.io/product/logs/?utm_source=nodeweekly&utm_medium=paid-community&utm_campaign=logs-fy26q4-logslaunch&utm_content=newsletter-logs-ga-launch-learnmore) — See logs, errors, and traces together in one place for full context. Debug faster with Sentry Logs. Sentry sponsor [Tasuku (タスク): A Minimal Task Runner for Node](https://github.com/privatenumber/tasuku) — Tasuku, Japanese for ‘task’, provides a clean way to break up processes into small tasks, which can then be run in the right order with progress displayed elegantly in the terminal. Think `make` but Node-flavored. [Live demo.](https://stackblitz.com/edit/tasuku-demo?devtoolsheight=50&file=index.js&view=editor) hiroki osame 🛑 [fkill 10.0: A Cross-Platform Way to Kill Processes](https://github.com/sindresorhus/fkill) — Working on macOS, Linux, and Windows, this gives you a nice API for kill processes. For example: `await fkill('chrome', {waitForExit: 2000});` Sindre Sorhus [CSSOM: A CSS Parser Written in Pure JavaScript](https://github.com/acemir/CSSOM) — Also a partial implementation of CSS Object Model. Nikita Vasilyev [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/spj3hsrlthowmnt1i4se.jpg)](https://github.com/anders94/render.js) [Render.js: A Raytracing Renderer with RenderMan Format Support](https://github.com/anders94/render.js) — Created at Pixar in the 80s, the [_RenderMan Interface Specification_](https://en.wikipedia.org/wiki/RenderMan_Interface_Specification) was an early API for building 3D scenes. Anders has been building a Node-based, 90s-style renderer for the format _“as a stroll down amnesia lane”_ in pure JavaScript. Anders Brownworth - [MongoDB Node.js Driver 7.0](https://github.com/mongodb/node-mongodb-native/releases/tag/v7.0.0) – The latest official MongoDB driver. I love how thorough MongoDB's release notes always are for these! - [pg-promise v12.3](https://github.com/vitaly-t/pg-promise) – Extended Postgres driver for Node with automatic connections and transactions, query generation, and more. - [file-type 21.1](https://github.com/sindresorhus/file-type/releases/tag/v21.1.0) – Detect the file type of a file, stream, or data. Now also supporting `.tar.gz` files and Windows registry files. - [pg-boss 12.0](https://github.com/timgit/pg-boss/releases/tag/12.0.0) – Postgres-based job queuing system for Node. Has migrated to ESM, so existing users have some changes to make. - 🤖 [Repomix 1.9](https://github.com/yamadashy/repomix/releases/tag/v1.9.0) – Pack an entire repository into a single, LLM-friendly file. - [Fastify 5.6.2](https://github.com/fastify/fastify/releases/tag/v5.6.2) – The fast, low overhead Node web framework. - [Prisma 6.19](https://github.com/prisma/prisma/releases/tag/6.19.0) – Popular ORM for Node.js and TypeScript. - [node-mssql 12.1](https://github.com/tediousjs/node-mssql) – Microsoft SQL Server client library. 📰 Classifieds 🐱 **[ConfigCat Feature Flag Service](https://configcat.com/promotions/node-weekly/?utm_source=cooperpress_newsletter&utm_medium=sponsor&utm_campaign=cooperpress_node_202510)** lets you release and roll back features safely without code changes. Set it up in minutes! **[Save 25% now!](https://configcat.com/promotions/node-weekly/?utm_source=cooperpress_newsletter&utm_medium=sponsor&utm_campaign=cooperpress_node_202510)** --- Add e-signatures to your Node.js app in minutes with the BoldSign Node.js SDK—powered by **[our e-signature API. Get your free API key today](https://boldsign.com/esignature-api/?utm_source=cooperpress&utm_medium=cpc&utm_campaign=nodeweekly_classified).** 📢 Elsewhere in the ecosystem A roundup of some other interesting stories in the broader landscape: [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60,q_auto/v0djw45wiicxyxptccxq.jpg)](https://watilde.github.io/KokoScript/) - 🇯🇵 Fancy writing JavaScript in Japanese _(above)_? [Say こんにちは to KokoScript.](https://watilde.github.io/KokoScript/) - On the topic of Japan, if you know a company in Japan that would benefit from having one of JavaScript's best-known names as an employee, [Dan Abramov is looking for a job in Japan right now.](https://overreacted.io/hire-me-in-japan/) - I enjoyed Lea Verou's [cute proxy-based trick for creating JavaScript symbols](https://front-end.social/@leaverou/115455940452841916) on demand. - [GitHub did a quick interview with TypeScript co-creator Anders Hejsberg](https://github.blog/developer-skills/programming-languages-and-frameworks/typescripts-rise-in-the-ai-era-insights-from-lead-architect-anders-hejlsberg/) about the rise of TypeScript (now the #1 language on GitHub) and its role in a more AI-oriented world. - Ben Visness writes about [how Mozilla has overhauled its internal tools for visualizing JavaScript and WebAssembly compilation](https://spidermonkey.dev/blog/2025/10/28/iongraph-web.html), complete with interactive graphs. - If you need to embed JavaScript into places Node doesn't yet go, [Hako is an interesting WebAssembly-oriented option](https://andrews.substack.com/p/embedding-typescript). **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Sponsorship:** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Cancel your subscription](https://nodeweekly.com/leave/*|UID|*) or [change your address](https://nodeweekly.com/edit_subscription/*|UID|*).