“I’m sharing difficult news on behalf of the UK Wild Otter Trust – news that has left me and our volunteers devastated. As some supporters know, my wife and I […]

Webrings for Astro, the JS Framework!

Hacktoberfest: a month-long celebration of open-source projects, their maintainers, and the entire community of contributors.

Take the State of JavaScript survey

Sometimes npm packages are compromised and published with malware. Luckily, there are companies like [Socket], [Snyk], and [Aikido] that detect these compromised packages early. The npm registry usually removes the affected versions within hours. However, there is always a window of time between when the malware is published and when it is detected, during which you could be exposed. Fortunately, there are some things you can do with pnpm to minimize the risks.

npm author Qix’s account was compromised, with malicious versions of popular packages like chalk-template, color-convert, and strip-ansi published.