Stay updated with breaking news from Node Package Manager. Get real-time updates on events, politics, business, and more. Visit us for reliable news and exclusive interviews.
This is a talk and slides from Narrascope 2022, held online in July 2022. It completes a trilogy — I also spoke at Narrascope I and Narrascope II. I’m grateful to the IFTF, and particularly to Judith Pintar and Andrew Plotkin, for arranging the opportunity.
Node.js is still the most widely used JavaScript runtime environment, but Deno is more secure and brings modern advantages. Compare Deno and Node.js and decide which is right for your next project.
The discovery adds to the growing list of recent incidents where threat actors have used public code repositories to distribute malware in software supply chain attacks.
The malware packages had names that were common typosquats of a legitimate widely used Python library. One was downloaded hundreds of times.
The campaign uses four malicious packages to spread "Volt Stealer" and "Lofy Stealer" malware in the open source npm software package repository.