Not pretty, not Windows-only: npm phishing attack laces popular packages with malware The popular npm package "is" was infected with cross-platform malware, around the same time that linting utility packages used with the prettier code formatter were infected with Windows-only malware. This was likely caused by a phishing attack using a typosquatted clone of the official npm site. The "is" package is used for …
I have actually worked alongside web devs for a fair bit of my career, so I'm not just making shit up. It is one thing depending on these "non-essentials", but if I were the boss I would limit their use to prototyping.
Next step - download the package _locally_ and check it over. Use your local copy.
Even better, find the bits of functionality that you actually need and extract & sanitize them. Write your own code.
Not exactly rocket science!
This. It looks really easy and a no-brainer because you're not at the end of your second 60 hour week with a burgeoning inbox and 50 unread slack notifications demanding you went live yesterday.
Even the most seasoned devs and sysadmins can make big booboos under these kinds of pressures.
"Next step - download the package _locally_ and check it over. Use your local copy."
Not always possible due to licence retrictions when using commercially
"Even better, find the bits of functionality that you actually need and extract & sanitize them. Write your own code."
Yes, this. If you can't licence it for local use, then don't use it :-)
I'm still not entirely sure. But here's one definition:
is.defined = function (value) {
return typeof value !== 'undefined';
};
It's syntactic sugar for a language feature.
Some of the others are more involved and there are subtle issues which may need wrapping up in a function (i.e. cross realm). But Jordan could get this in the language, if he wanted. I like Javascript, but I despair of some of this.
