“slopsquatting, a new term for a surprisingly effective type of software supply chain attack that emerges when LLMs “hallucinate” package names that don’t actually exist. If you’ve ever seen an AI recommend a package and thought, “Wait, is that real?”—you’ve already encountered the foundation of the problem.

And now attackers are catching on.”

The Rise of Slopsquatting: How #AI Hallucinations Are Fueling... https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks #npm #dev #infosec

#hugops to #npm today. Private package installs and "npm publish" are failing for older access tokens. You can clear the issue with a fresh "npm login". May need to update tokens in your CI systems for deployment as well. More on their status page. #programming

npm: 3 moderate severity vulnerabilities

me: npm audit fix --force

npm: 5 moderate severity vulnerabilities

AAAAAAAAAAAAAAAAAAAAA

Malware found on npm infecting local package with reverse shell

｢ For the first time, RL researchers discover malicious locally-installed npm packages infecting other legitimate packages ｣

https://www.reversinglabs.com/blog/malicious-npm-patch-delivers-reverse-shell

Hoo boy am I tired of seeing messages in my browser's JavaScript from some deep transitive dependency of the app I work on, saying "We're about to remove support for <feature that a slightly less nested transitive dependency uses>, sucks to be you."

This whole developer ecosystem is a nightmare of endless compatibility problems, 90% of them trivially avoidable with a moment's thought.

Exactly when I needed it, it appeared to me: NPM's workspaces feature.

Workspaces is a generic term that refers to the set of features in the npm cli that provides support to managing multiple packages from your local file system from within a singular top-level, root package.

workspaces | npm Docs https://docs.npmjs.com/cli/v8/using-npm/workspaces

It seems that while I was building my huge monorepo in good old JS5 #javascript I missed the #npm workspaces concept that emerged somewhere along those years.
Now that I hit the wall with #deno and a bunch of dependency-wise intertwined packages, I've learned about deno's workspace feature that is a reimplementation of npm's workspaces.
Ok, let me see if I can organize my code using workspace(s)...

Malware Found on npm Infecting Local Package With Reverse Shell, by @reversinglabs.com:

https://www.reversinglabs.com/blog/malicious-npm-patch-delivers-reverse-shell

Seems #npm is having a bad day

https://status.npmjs.org/

Anyone else seeing #npm package installation failures? I can see https://status.npmjs.org/incidents/hdtkrsqp134s, but the "scoped to certain keywords" is both weasel-wording and confusing ... #npmjs #javascript #devops

hah, npm issue right now, which https://status.npmjs.org/ was quite tardy in reporting

Package Manager for Markdown

I'm working on a project that is intended to encourage folk to make markdown text files which can be bundled together in different bundles of text files using a package manager.

Question for coders; Which package manager would you suggest I use?

Main criterias (in order) are:

1. Easy for someone with basic command line skills to edit the file and update version numbers and add additional packages.

2. All being equal, more commonly and easy to setup is preferred.

#Markdown #CommonMark #PackageManager #Programming #Dev
#NPM #RubyGems #Cargo #PickingAMastodonInstance
#Ruby #Python #Rust #Javascript #NodeJs #Lisp #CommonGuide

In today's Supply Chain News ...

Eleven oooold npm packages were hijacked to steal API keys. Wonder how many of them jise are just sitting on n someone's built pipeline with "latest" as the version parameter?

https://www.sonatype.com/blog/multiple-crypto-packages-hijacked-turned-into-info-stealers

h/t to SonaType for the top notch research.

#supplychain
#npm

#Infostealer campaign compromises 10 #npm packages, targets devs

https://www.bleepingcomputer.com/news/security/infostealer-campaign-compromises-10-npm-packages-targets-devs/

New #npm attack poisons local packages with backdoors

https://www.bleepingcomputer.com/news/security/new-npm-attack-poisons-local-packages-with-backdoors/

Ok, normal patterns after an hour of excitement.

ReversingLabs has a good writeup of an npm package infected with malware that generates a backdoor. Great way to get insight into the patterns the baddies follow.

https://www.reversinglabs.com/blog/malicious-npm-patch-delivers-reverse-shell

Quick question for the node.js developers on the fediverse.

How would I go about monitoring an app's memory and CPU usage over time?