
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
@lando/core
Advanced tools
These are the core libraries that power Lando. They are implemented in [@lando/cli
] and things like Pantheon LocalDev and WordPress VIP CLI.
On a high level they serve as:
An abstraction layer Lando vastly reduces the complexity of spinning up containers by exposing only the most relevant config for a given "service" and setting "sane defaults". Lando also provides "recipes" which are common combinations of services and their tooling that satisfy a given development use case - e.g. Drupal, Python, Laravel, Dotnet, etc.
A superset Lando provides ways for developers to run complex commands, build steps and automation on their services without the hassle of custom Dockerfiles or long "docker exec" commands. Think lando yarn add express
. Think clear my applications cache after I import a database. Think install this core-extension before my appserver starts and then composer install
after it does.
A utility Lando handles some of the more arduous configuration required for a good Docker Compose setup - e.g. proxying, nice urls, cross-application networking (think Vue.js frontend talking to a separate Laravel backend), host-container file permission handling, file sharing, per-container SSL certificate handling, ssh-key handling, etc.
const Lando = require('@lando/core');
const lando = new Lando(config);
// bootstrap and go
return lando.bootstrap(bsLevel).then(lando => {
lando.getApp().init().then(() => cli.run(getTasks(config, cli.argv()), config));
});
const
For more info you should check out the docs:
If you have a question or would like some community support we recommend you join us on Slack.
If you'd like to report a bug or submit a feature request then please use the issue queue in this repo.
We try to log all changes big and small in both THE CHANGELOG and the release notes.
Made with contributors-img.`
v3.25.5 - September 9, 2025
FAQs
The libraries that power all of Lando.
The npm package @lando/core receives a total of 54 weekly downloads. As such, @lando/core popularity was classified as not popular.
We found that @lando/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.