本文最初发布于 RedMonk。 最近，JavaScript 软件包管理领域发生了重大变化。虽然 npm 仍是 Node.js 运行时环境中使用的 JavaScript 软件包注册中心和管理器，但值得讨论的是，对于 JavaScript 代码交付这个更大的问题，这些变化有什么影响。具体来说，我想到了最近出现 ...

新京报讯 据国家网络安全通报中心消息，监测发现，全球主流JavaScript软件包管理平台npm遭“沙虫”（Shai-Hulud）供应链投毒攻击。攻击者攻陷了npm官方维护者账户，并在短时间内批量投放大量恶意软件包，涉及300余个独立程序包的600余个恶意版本，影响多个热门开源项目。当开发者安装恶意依赖包后，程序会自动在本地主机、CI/CD流水线环境执行恶意代码，窃取GitHub Token、np ...

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...

快科技5月25日消息，今日，国家网络安全通报中心发文称，监测发现，全球主流JavaScript软件包管理平台npm遭“沙虫”（Shai-Hulud）供应链投毒攻击。 据通报，攻击者攻陷了npm官方维护者账户，并在短时间内批量投放大量恶意软件包，涉及300余个独立程序包的600余个恶意版本，影响多个热门开源项目。 当开发者安装恶意依赖包后，程序会自动在本地主机、CI/CD流水线环境执行恶意代码，窃取 ...

Is the public NPM JavaScript package registry going away? NPM, the company behind the popular online repository of Node.js and JavaScript code, insists it will remain, despite a recent rumor to the ...

GitHub, the developer repository owned by Microsoft, made a little deal of its own this morning when it bought JavaScript packaging vendor npm for an undisclosed amount. As GitHub CEO Nat Friedman ...

OAKLAND, Calif.--(BUSINESS WIRE)--npm, Inc., the open source JavaScript developer tools provider and operator of the world’s largest software registry, today announced npm Pro, the first professional ...

A hacker has gained access to a developer's npm account and injected malicious code into a popular JavaScript library, code that was designed to steal the npm credentials of users who utilize the ...

人民财讯5月25日电，国家网络安全通报中心监测发现，全球主流JavaScript软件包管理平台npm遭“沙虫”（Shai-Hulud）供应链投毒攻击。攻击者攻陷了npm官方维护者账户，并在短时间内批量投放大量恶意软件包，涉及300余个独立程序包的600余个恶意版本，影响多个热门开源项目。当开发者安装恶意依赖包后，程序会自动在本地主机、CI/CD流水线环境执行恶意代码，窃取GitHub Token、 ...

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources. Dany Lepage discusses the architectural ...

Backbone has suffered a steep decline since 2013 for front-end JavaScript frameworks, while Express remains the clear king of back-end frameworks Judging by downloads from the NPM registry, React, ...

Tens of thousands of developers using weak credentials to secure their npm accounts inadvertently put more than half of the npm packages (JavaScript libraries and tools) at risk of getting hijacked ...