🦋 jddalton.bsky.social

337 posts

🦋 jddalton.bsky.social banner
🦋 jddalton.bsky.social

🦋 jddalton.bsky.social

@jdalton

Lodash creator • sometimes TC39 delegate • protecting supply chains at https://t.co/eYz05o0jqW • Ex (Bun, Salesforce, Node core, Electron WG, Microsoft)

Own Opinions, Population Me. Beigetreten Nisan 2008
45 Folgt25.8K Follower
Angehefteter Tweet
🦋 jddalton.bsky.social
Along with the blog post there's a recording of the interview. Listen to the full interview OR the last 10 minutes (linked) → youtube.com/watch?v=ZbWx6s…
YouTube video
YouTube
OpenJS Foundation@openjsf

Lodash gets 100M+ downloads a day. For years, it was primarily maintained by one person: @jdalton Then life happened. He stepped back. Now Lodash is entering a new phase with shared governance and support from the OpenJS Foundation. Big reminder: Open source isn’t just code. It’s people. Read more about our conversation with John-David here: openjsf.org/blog/burnout-i…

English
1
1
9
8.3K
🦋 jddalton.bsky.social retweetet
Stas Kulesh
Stas Kulesh@staskulesh·
@tom_doerr I tested this and embedded into Tamp.dev as one of many tools for token compression
Stas Kulesh tweet media
English
0
3
4
760
🦋 jddalton.bsky.social retweetet
Jon Church
Jon Church@jonchurch·
Okay I looked it up. The npm registry is having a banger year, downloads are up 130% YoY, and March alone saw a 35% increase (!!)
Jon Church tweet media
English
1
2
2
438
🦋 jddalton.bsky.social retweetet
OpenJS Foundation
OpenJS Foundation@openjsf·
Understanding JavaScript security is more important than ever 👀 Check out our free training course to better spot security flaws in JavaScript apps, design safer systems, and bring a security-first mindset to every stage of development. Details here: bit.ly/4vhXCay
OpenJS Foundation tweet media
English
1
5
24
2.9K
🦋 jddalton.bsky.social retweetet
Peter Pistorius
Peter Pistorius@appfactory·
This is agent-ci.dev, it runs the same native GitHub Actions Runner in a container. The difference is the control pane: Which is a local http server. So it never communicates with GitHub.com, because of this we can do all kinds of interesting things: 1. 0ms cache restores (copy on write mounts) 2. pause-and-retry on failures (bash injection in step.) 3. 100% compatible with GH actions. (just a control pane.)
Peter Pistorius@appfactory

Running GitHub Actions locally never gets old.

English
10
15
216
31.8K
🦋 jddalton.bsky.social retweetet
Sarah Gooding
Sarah Gooding@sarahgooding·
Wanted to warn the #NodeJS community: This campaign is active. Thank you to the maintainers who shared their stories - some of these came frighteningly close. One got all the way to the fake meeting before walking away. The more we talk about this, the harder it is for these attacks to succeed.
Socket@SocketSecurity

🚨 New Investigation: Attackers are hunting the maintainers behind Lodash, Fastify, buffer, Pino, mocha, Express, and #Nodejs core, because compromising one of them means write access to packages downloaded billions of times a week.  socket.dev/blog/attackers…

English
3
16
59
16.5K
🦋 jddalton.bsky.social retweetet
Feross
Feross@feross·
Great piece from @a16z. A few things I’d add from the front lines of detecting the Axios attack: Socket detecting the attack 16 minutes before publication is worth dwelling on. We caught plain-crypto-js because its behavior was anomalous the moment it appeared on npm – postinstall script, network access, OS fingerprinting, binary download, self-deletion. No CVE needed. The package told us what it was by what it did. The core issue is that AI agents treat npm install as a solved problem. It isn’t. Every dependency decision is a trust decision, and right now agents are making thousands of those decisions per day with zero security context. We need to give agents the same visibility into package behavior that we’d want a human developer to have – but at machine speed.
a16z@a16z

The software supply chain has become the most critical and least-defended attack surface in modern software development. This week, someone hijacked one of the most popular packages on the internet and used it to install a backdoor on every machine that ran npm install. a16z's @MaikaThoughts, @zanelackey, and Joel de la Garza on how @SocketSecurity detected the Axios attack within 6 minutes, why AI is compressing software supply chain attack timelines, and why defenders have to move at machine speed to save the agents: a16z.news/p/et-tu-agent-…

English
9
25
144
41.3K
🦋 jddalton.bsky.social retweetet
Matteo Collina
Matteo Collina@matteocollina·
Node.js didn't always use llhttp. The original `http-parser` was a C library that was "totally unmaintainable". Any change meant recompiling. It was rigid, static, and couldn't be configured. 😬 We (@platformatic) did a deep dive with @kettanaito to explore the intricacies of @nodejs HTTP layer!
Matteo Collina tweet media
English
2
5
59
8.7K
🦋 jddalton.bsky.social retweetet
Feross
Feross@feross·
Socket is free for open source maintainers. We're launching the @SocketSecurity for Open Source program -- any open source maintainer can get a free Team plan to protect their project from supply chain attacks. Open source is critical infrastructure. Millions of companies depend on packages maintained by small teams and volunteers. These maintainers are high-value targets but rarely have access to enterprise security tooling. That's wrong. We want to fix it. What you get: ✅ Full dependency scanning across your project ✅ Real-time alerts for malicious packages in your dependency tree ✅ Check every PR to make sure no malicious dependencies are added -- including PRs from outside contributors If you maintain an open source project, send an email to support[at]socket[dot]dev and we'll get you set up!
English
14
30
114
12.9K