Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Security News
Sarah Gooding
November 5, 2024
At the end of October, JSR, the open source package registry for modern JavaScript and TypeScript, convened its first working group meeting. Although Deno currently pays to keep JSR running, the registry is not a Deno project. Its creators intend for JSR to be an open source community-run project, and they are working towards adopting an open governance model.
During the first JSR Working Group meeting, participants discussed the current state of JSR in the JavaScript ecosystem, the roadmap, and recruiting for governance.
They opened by giving a brief introduction to JSR with a slide deck that clearly articulates what JSR is and what it isn’t, and where its modules currently operate:
JSR and Deno engineer Luca Casonato highlighted the mission for the project - to “level up the JavaScript ecosystem” and ensure that package management is ready for the next 10 years of JavaScript development.
In their inaugural working group meeting, the JSR team outlined a clear and strategic roadmap centered around two primary focus areas: enhancing the publishing process for developers entrenched in the Node ecosystem and elevating the overall consumer experience for package users.
JSR currently enables the publishing of new TypeScript packages but lacks guidance for type checking, does not consistently handle existing .js and .d.ts file pairs. Local testing of npm-emitted code is still challenging, and JSR does not support publishing JSX.
Recognizing the vast number of developers who rely on Node.js, the JSR roadmap aims to simplify the transition and integration of existing Node packages into the JSR registry through these key initiatives:
On the consumer side, JSR is committed to making package usage more seamless and intuitive, through a few key improvements:
JSR’s collection of community packages has grown to more than 7,400 packages in the nine months since it went into public beta. Developers rave about how much time is saved by using JSR to publish Typescript packages, and the registry is solidifying its position as a vital resource in the JavaScript ecosystem.
JSR is currently hosted on Google Cloud with a Rust backend, Postgres database, and Deno/Fresh on the frontend. Current costs are $400 a month for database and compute and JSR’s engineers don’t expect this to grow much. The Deno company is willing to pay for hosting infrastructure, even after moving to a foundation.
The main concerns for long-term sustainability are the variable cost of bandwidth, which is increasing as registry usage grows. The group is hoping to find some CDN partners that can help lessen the bandwidth costs.
As the registry grows, the group has discussed moving JSR into an open foundation by establishing a JSR governance board to oversee the transition. The group noted that JSR is already operationally detached from Deno, along with the JSR brand, so it should not be complicated to move it into an open foundation where it won’t be controlled by a single entity.
The working group is currently seeking trusted individuals with track records to oversee this process and decide the overall direction of the registry. They are also looking for engineering help on JSR, which is written in Rust and TypeScript. It’s open source and there are some issues already labeled as good-first-issue in the JSR repository.
A JSR moderation group is another missing piece of the puzzle that will be put in place following the formation of the JSR governance board. This group will handle the day-to-day administration of the public registry. This includes operations like enforcing naming and content policies, responding to user requests and issues, and increasing limits. The group will meet on a regular basis to discuss and evolve the policies and make critical decisions.
Check out the meeting recording and the slides for more details on applying to contribute to JSR’s governance, moderation, and engineering efforts. The working group plans to hold a bi-weekly recurring open meeting where they will answer questions, respond to feedback, and collectively plan and discuss the future roadmap of JSR. The next meeting is happening this week on Friday, November 8, at 7PM EST.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.