Node.js Security

The Node Security Platform is joining @npmjs buff.ly/2qgpc8C

Automating Vulnerable Dependency Checking in CI Using Open Source by @varrunr sec.okta.com/articles/2020/…

it’s official! we’re now a part of @github. excited for the next chapter of npm: buff.ly/2XQ7fjR

Big news! We’re excited to announce that @npmjs will be joining @GitHub! We're thrilled to join an organization as committed to open source as we are, so that the npm registry can remain free & public forever. You can read more about this new chapter here: buff.ly/3aYygVf

Going live at 9AM PT! Will be talking about JavaScript ecosystem security and solutions you can get involved in.

Did you ever want to know how a pentester makes their way from bug to exploit? Read about how @truesec found and exploited a bug in hot-formula-parser (CVE-2020-6836) blog.truesec.com/2020/01/17/rev…

Please update your npm cli to v6.13.4 as soon as you can. npm i npm -g blog.npmjs.org/post/189618601…

Great writeup about a remote code execution (RCE) vulnerability in the Strapi framework and the quick response by the Strapi team. bittherapy.net/post/strapi-fr…

the npm security team has been hard at work building infrastructure to do behavioral analysis of npm packages at scale. vp of security, @adam_baldwin, explains what this entails (+ a sneak peek at the security insights API): buff.ly/35ct9hw

This Node.js Best Practices guide by @nodepractices has some great security guidance. github.com/goldbergyoni/n…

Recent Study Estimates That 50% of Websites Using WebAssembly Apply It for Malicious Purposes infoq.com/news/2019/10/W…

We get a lot of requests from people wanting to do research around malware in the Registry. It will be really exciting to see what the community does with this data!

Did you miss us? Well we're back and tweeting. The npm security team has taken over the nodesecurity twitter account and will be keeping you up to date on JavaScript security related happenings.

The Daily Swig speaks to npm’s @adam_baldwin about improving security for the world’s biggest repository of open source software packages portswigger.net/daily-swig/the…

The Node Security Platform Service is shutting down tomorrow: buff.ly/2KKjxAT

On 9/30 the Node Security Platform will stop working. Here’s what you can do: buff.ly/2KKjxAT

The Node Security Platform is shutting down on 9/30: buff.ly/2KKjxAT

JavaScript’s definitive listing of known package vulnerabilities is moving to @npmjs Here’s how to use it: buff.ly/2KKjxAT

HashWick - a new vulnerability found by @indutny - impacts all v8js releases.

Are you prepared to move on from the Node Security Platform service? Here’s what you can do: buff.ly/2KKjxAT

🔒node.js security release, time to update. nodejs.org/en/blog/vulner…