🎉 Happy release Tuesday! Today marks a major milestone for the npm CLI team - we've officially cut npm@7.0.0. If you've been following along this past year, or more, you'll now that we've been working... | Continue reading
<< Why keep package-lock.json? A new beta version of npm appears! tl;dr - Run npm i -g npm@next-7 right now, and tell us about any problems you encounter with it. This is a big one, you're going to... | Continue reading
<< Arborist Deep Dive One common question we've gotten a few times now, once we announce that npm v7 will include support for yarn.lock files, is "Why keep package-lock.json at all, then? Why not... | Continue reading
On September 29th, 2019, npm turned 10 years old and we all celebrated the incredible story of npm. Today, I'm announcing my departure from npm, and that has me looking back at the last 10 years and... | Continue reading
TL;DR Until today, you couldn't unpublish packages, or package versions, older than 72 hours without contacting support (background available here and here). Because this is our most popular support... | Continue reading
tl;dr - Update to npm v6.13.4 as soon as possible on all your systems to fix a vulnerability allowing arbitrary path access. The Vulnerabilities In versions of npm prior to 6.13.3 (and versions of... | Continue reading
Happy Tuesday! Here on the Community & Open Source Team we’ve been working hard, in front of and behind the scenes, to provide real value and unlock developer potential. With that in mind, I’m happy... | Continue reading
This is the second in a series of blog posts we're running to preview and gather input on the new security insights API we're developing. Today's topic: malware. For years npm has maintained the most... | Continue reading
Something I think is very important to supply chain security is to have the right information available to make decisions about risk. Existing security tools currently report known vulnerabilities at... | Continue reading
Recently, I happened across a weird line in read-package-tree while reading through the code to see where I might get started implementing Workspaces for the npm CLI. At the time, I was so deep in the... | Continue reading
The npm public registry, like the JavaScript ecosystem at large, is experiencing exponential growth. The longevity of the registry and its continued availability as a public resource depends on... | Continue reading
Part of npm, Inc.’s mission is to ensure the sustainability of the Open Source JavaScript ecosystem, and without fair compensation for developers, sustainability is impossible in the long term. For... | Continue reading
Motion on the npm CLI project has been accelerating, and we're now moving forward with a clear direction and vision. This document outlines what's in store for the remainder of the npm v6 line, and... | Continue reading
Not to bury the lede: I have resigned from npm. I made the decision to leave in early May, and my final full-time day was July 1st, but as a co-founder it takes a long time to untangle yourself so I... | Continue reading
Not to bury the lede: I have resigned from npm. I made the decision to leave in early May, and my final full-time day was July 1st, but as a co-founder it takes a long time to untangle yourself so I... | Continue reading
Today, we’re excited to announce that, in collaboration with GitHub’s token scanning partnership program, we’ve taken our existing token revocation efforts a step further. Whenever you commit or push... | Continue reading
Yesterday, the npm, Inc. security team, in collaboration with Komodo, helped protect over $13 million USD in cryptocurrency assets as we found and responded to a malware threat targeting the users of... | Continue reading
One common question from people using npm to publish, especially on CI systems, is how best to automate the process, especially when dealing with multiple branches. For a while now, I've been using a... | Continue reading
When I ask software developers what their biggest security concerns are, I typically hear something about malicious code in their npm packages. The average npm package has over 2000 dependencies, so... | Continue reading
Q: Hi! Can you state your name, what you do, and/or what your company does? A: Hey, I'm Golo, founder and CTO of the native web. We provide consulting, training and development for Node.js,... | Continue reading
Coming up as a software developer in Open Source, I’ve long believed that the best path to success is to depend on the strengths of others. One reason why I wrote a package manager in the first place... | Continue reading
This study is adapted from my presentation npm and the Future of JavaScript. No data is perfect; if you have questions about ours you can read about the methodology used to gather this data.npm has... | Continue reading
This is an analysis of the event-stream incident of which many of you became aware earlier this week. npm acts immediately to address operational concerns and issues that affect the safety of our... | Continue reading
This is an analysis of the event-stream incident of which many of you became aware earlier this week. npm acts immediately to address operational concerns and issues that affect the safety of our... | Continue reading
This post was written by Benjamin Coe, Product Manager at npm, Inc. and lead maintainer of yargs and Istanbul for the Node.js Collection. It covers work that has gone into introducing native code... | Continue reading
This post was written by Benjamin Coe, Product Manager at npm, Inc. and lead maintainer of yargs and Istanbul for the Node.js Collection. It covers work that has gone into introducing native code... | Continue reading
What if installs were so fast they could happen in the background, just by using Node? What every file in your dependencies could be guaranteed to be bit-by-bit identical to what’s on the registry?... | Continue reading
I’m happy to announce that you can now beta-test two-factor authentication protection for individual packages in the npm Registry. This setting requires that every publication of a protected package... | Continue reading
Early in the morning of July 12, an individual gained access to an npm publisher’s account and used this access to publish an unauthorized update of a popular package. The update included malicious... | Continue reading
I am pleased to announce that npm is transitioning its public issue trackers from GitHub to a Discourse site at npm.community. This will allow us to give the community a single place to report bugs... | Continue reading
Earlier this year, we announced npm, Inc.’s acquisition of ^Lift Security and the Node Security Platform and promised to provide updates as our teams combined to protect the world’s largest JavaScript... | Continue reading
We’re continuing our analysis of the results of last winter’s JavaScript Ecosystem Survey, a survey of over 16,000 developers conducted by npm in collaboration with the Node.JS Foundation and the JS... | Continue reading
Last month, we announced npm@6, which includes a powerful new tool to protect the safety of your code, npm audit. Together with new automatic alerts when a user installs code with a known security... | Continue reading
Early May 2nd, the npm security team received and responded to reports of a package that masqueraded as a cookie parsing library but contained a malicious backdoor. The result of the investigation... | Continue reading
In coordination with today’s announcement of Node.js v10, we’re excited to announce npm@6. This major update to npm includes powerful new security features for every developer who works with open... | Continue reading