
Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
@oliversalzburg/js-utils
Advanced tools
Why modern Yarn?
Among other things, Yarn is robust, performant and extremely versatile when it comes to repository management. The given configuration provides a very solid first-time experience. Some of the things that make modern Yarn great can be seen in this project template.
Why esbuild?
We want fast builds. The code is still checked for correctness in the editor and in CI.
Why the MkDocs Markdown?
If you're going to want to build any documentation site, you will appreciate having auto-formatted to this style from the start. Using mkdocs-material for documentation sites is highly recommended. The Python Markdown ecosystem is much more versatile and performant than the JS/TS space.
Why is PnP disabled?
While PnP is generally preferred for its strictness, using it still incurs a lot of friction. Because PnP is enabled by default in modern Yarn, this deters many users from adopting modern Yarn. Thus, this project uses Yarn's node-modules
linker, the behavior of which should be very familiar to most adopters.
Why is telemetry disabled?
Whenever possible, the disclosure of any data should be opt-in. Please refer to the document linked above, and enable telemetry after carefully reading it.
Why not Zero-Installs?
Zero-Installs are purely a .gitignore
-controlled feature. Most new adopters do not expect the behavior of the default configuration and some adopters have raised concerns over long-term effects. Enable it after carefully reading the article linked above.
Why not use Husky for the hook?
Husky is more complex than what is required to install the hook in a modern Yarn repository. We also do not want to hand over control over repository behavior to a dependency.
FAQs
[](https://www.npmjs.com/package/@oliversalzburg%2Fjs-utils) [](https://github.com
The npm package @oliversalzburg/js-utils receives a total of 579 weekly downloads. As such, @oliversalzburg/js-utils popularity was classified as not popular.
We found that @oliversalzburg/js-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
Security News
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
Product
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.