
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
PairJS is basically a supercharged, live collaborative editing equivalent of python -m SimpleHTTPServer. You pick a directory and it will not only serve up static files as a web server, but also give you and anyone else on your network access to edit those files via the handsome Ace editor. Better still, all that editing can happen concurrently, with no messy locks or conflicts, thanks to the unfathomable voodoo of ShareJS.
All files are saved back to your disk when they're edited so you can share something you're working on with a friend or coworker, edit it collaboratively, and then just git commit (or whatever) the files when you're done. Open one window to edit some html and another for a live-updating view of the result. Open two editors and argue with yourself. Go crazy! The world is your highly concurrent oyster.
Assuming you have nodejs installed, just run this:
$ npm install -g pairjs
And once the slobbering dependency behemoth is satisfied, do this:
$ cd WHEREVER_I_WANT_GOSH
$ pairjs
Then go here: http://localhost:8000/
Hey, don't wreck all your files!
There is currently no auth. Edits are limited to the directory you provide, but giving someone access to write arbitrary data to a place you care about is inherently dangerous. There are no backups, so you should only use this in directories that are under source control or full of files that you never liked anyway. Your files will be accessible to anyone who can connect to your ip, so, y'know, if you see a guy with a handlebar moustache and devious eyes giving you that "I'm stealing your database passwords right out of your config file" grin from the other side of your favourite coffeeshop, don't come to me all like "you didn't tell me this would happen". Yes I did! Just then!
FAQs
Instant collaborative coding using the interweb!
The npm package pairjs receives a total of 4 weekly downloads. As such, pairjs popularity was classified as not popular.
We found that pairjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.