
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
chronos-package-manager
Advanced tools
A very very simple demo and guide for explaining package manager.
As a JavaScript developer, you may use package manager like npm or Yarn frequently.
However, do you know how a package manager works? Or, you may be curious about how to build a package manager.
Well, the purpose of this guide is not to let you re-invent a new wheel. There is no need to do that because both npm and Yarn are mature and stable enough. The purpose is just to explain how a package manager works under the hood. You can read the code, and the comments will explain how it works.
Note: To simplify the guide and make it as simple as possible, this demo doesn't handle some edge cases and catch errors and exceptions. If you are really curious about that, it's recommended to read the source code of npm or Yarn.
node_modules directory.yarn.lock or package-lock.json)yarn add or npm i <package> command)preinstall and postinstall)bin files.Read the source code in the src directory.
You can read the src/index.ts file in the beginning.
If you would like to try this simple package manager, just install it globally:
Via Yarn:
$ yarn global add tiny-package-manager
Via npm:
$ npm i -g tiny-package-manager
Then just go to a directory which contains valid package.json and run:
$ tiny-pm
MIT License (c) 2018-present Pig Fang
FAQs
The chronos package manager.
We found that chronos-package-manager demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.