Last Npm Incident Uncovers Security Vulnerability
Last week, the npm registry had an operations incident that caused a number of highly depended on packages, such as require-from-string, to become unavailable. While the incident was relatively straightforward to solve, it uncovered a major security vulnerability that could have been exploited to inject malicious code in projects using npm.
Package Containing Malicious Backdoor Makes its Way into NPM
The NPM security team removed a package masquerading as a cookie parser that actually contained a malicious backdoor, along with three other packages depending on it. The backdoor allowed attackers to inject arbitrary code into a running server and execute it.
TypeScript Roadmap: Enhanced Type System, More Productivity, and Improved Linting
Microsoft has detailed the priorities that will drive TypeScript development during the first six months of 2019. Albeit not yet committed, the current roadmap includes enhanced core type system, maximizing forward compatibility with new ECMA features, improving tools, including editor support and linting, and more.
Fable 2 Interview with Fable Creator Alfonso García-Caro
Fable entered its fourth year with a new major version that greatly improves its performance, code-generation, and stability. InfoQ has spoken with Alfonso García-Caro, Fable creator and maintainer.
A Conversation about ZipSlip, NodeJS Security, and BBS Hacking
Earlier this year, the popular Bower package manager was found vulnerable to archive extraction, allowing attackers to write arbitrary files on a user’s disk. As it turns out, the vector attacks used by this exploit have been known since the early days of BBS. InfoQ has taken the chance to speak with Liran Tal to learn more about software security, and NodeJS security in particular.