npm
There’s a RAT in my code: new npm malware with Bladabindi trojan spotted
Over the Thanksgiving weekend, Sonatype discovered new malware within the npm registry. This time, the typosquatting packages identified by us are laced with a popular Remote Access Trojan (RAT) ...
Tips for Managing npm Dependencies
Part of the reason why Node.js is so appealing is that it allows for easy application extensibility; you focus on your core competencies, and if you need additional features or functionality, you ...
Discord squashes critical Electron bugs: open source attacks continue to grow
My colleague has two kids, ages 9 and 12. Since the COVID lockdowns they have been playing more online games and each of them use Discord to chat with their friends during ...
Fake npm Packages Found in GitHub Repository
Security researchers discovered four vulnerable npm packages uploaded to GitHub that were capable of collecting the user’s IP address, geolocation and device hardware data. Not all attacks have a high-visibility profile. Some ...
From Prototype Pollution to full-on remote code execution, how can adversaries exploit npm modules?
The NodeJS component express-fileupload - touting 7 million downloads from the npm registry - now has a critical Prototype Pollution vulnerability ...
Find and Fix Vulnerabilities in Seconds using GitHub PR Reviews with Line Comments
Pull request line comments highlight the exact line(s) of code that introduced a policy violation, giving developers all the information they need to remediate open source risks and innovate securely without sacrificing ...
Custom Node Module Management using Private npm Registry Configured in Nexus Repository
When we are developing software applications, we design reusable components to apply the power and benefit of reuse. Reuse is still an emerging discipline. It appears in many different forms from ad-hoc ...
New in Nexus Repository 3.23: Nexus Intelligence via npm audit
We are excited to announce the official release of Nexus Repository 3.23. In this release, we continue the story of our enhanced JavaScript support with the new Nexus Intelligence via npm audit ...
Comparing npm Audit Versus AuditJS
A while back I wrote a blog post after a colleague shared a new JavaScript auditing tool called AuditJS. I wanted to update that based on more time with the tool, particularly ...
How to Access npm Packages After Securing Nexus Repository Manager
This article addresses those who are using, or having interest in using, Nexus Repository Manager as their package manager for npm packages, Docker images, etc., but also for those who are curious ...
