Page 3 - Node Package Manager News Today

The number of hackers targeting Apple devices with cryptominers is on the rise, report finds.

Open-source software (OSS) sits at the center of almost every digital technology moving the world since the early 1980s—laptops, cellphones, widespread internet connectivity, cloud computing, social media, automation, all the rainbow flavors of e-commerce, and even secure communications and anti-censorship tools.

A fully functional SentinelOne client is actually a Trojan horse that hides malicious code within; it was found lurking in the Python Package Index repository ecosystem.

Mitosis is the JavaScript compiler that lets developers "write once, run anywhere," then compile to Angular, Vue, Svelte, and more. It could lead to a universal model of front-end development frameworks.

Threat actors continue to push malicious Python packages to the popular PyPI service, striking with typosquatting, authentic sounding file names, and hidden imports to fool developers and steal their information.

This is a talk and slides from Narrascope 2022, held online in July 2022. It completes a trilogy — I also spoke at Narrascope I and Narrascope II. I’m grateful to the IFTF, and particularly to Judith Pintar and Andrew Plotkin, for arranging the opportunity.

Node.js is still the most widely used JavaScript runtime environment, but Deno is more secure and brings modern advantages. Compare Deno and Node.js and decide which is right for your next project.

The discovery adds to the growing list of recent incidents where threat actors have used public code repositories to distribute malware in software supply chain attacks.

The malware packages had names that were common typosquats of a legitimate widely used Python library. One was downloaded hundreds of times.

The campaign uses four malicious packages to spread "Volt Stealer" and "Lofy Stealer" malware in the open source npm software package repository.