Frühere Suchanfragen

Keine früheren Suchanfragen

Suchoptionen

Nur verfügbar, wenn angemeldet.
sueden.social ist einer von vielen unabhängigen Mastodon-Servern, mit dem du dich im Fediverse beteiligen kannst.
Eine Community für alle, die sich dem Süden hingezogen fühlen. Wir können alles außer Hochdeutsch.

Verwaltet von:

Serverstatistik:

1,8 Tsd.
aktive Profile

sueden.social: ÜberStatusProfilverzeichnisDatenschutzerklärung

Mastodon: ÜberApp herunterladenTastenkombinationenQuellcode anzeigenv4.4.3

#node

12 Beiträge12 Beteiligte0 Beiträge heute
Bfritz0815

Einige sehr oft als dependencies genutzte #npm Pakete sind kompromittiert:

aikido.dev/blog/npm-debug-and-

Zeit, die eigenen ".lock" Dateien nach den betroffenen dependencies und von Allem SUB-DEPENDENCIES zu durchsuchen.

Auch sinnvoll:
package.json hat ein property "overrides", mit dem man pakete mit sicherheitslücken ausschließen kann

#packages #dependencies #compromised #Security #malware #node #NodeJS #npm #npmcompromised #yarn #bun

Please forward @uugrn @RaumZeitLabor

www.aikido.devnpm debug and chalk packages compromisedThe popular packages debug and chalk on npm have been compromised with malicious code
*
JdeBP

As someone who has done a fair amount of code dealing with ECMA-35 and ECMA-48, today I discovered that node has a has-ansi package.

It is on version 6. It is 7 lines long. It requires 2 other packages. And it is marked beta.

There's an entire separate package with a complete infrastructure of its own for a single regular expression.

This degree of incohesion is mad.

@ska @dalias #node #npm #ECMA48

Angerman 🦅

🚨 NPM supply-chain compromise: over 2B weekly downloads impacted

@aikidosecurity reports that popular #packages maintained by #qix (including #chalk, #debug, #ansistyles, #supportscolor, and others) were compromised.

These packages are deeply embedded in the #Node.js #ecosystem, used by frameworks, build tools, and apps worldwide.

Meh…. 🫤 supply-chain security isn’t optional.

#sbom ?
-Audit dependencies regularly
-Pin versions where possible
-Monitor advisories and lockfile integrity

Source: aikido.dev/blog/npm-debug-and-

#infosec
Nikita Karamov

Back in 2020, I wanted to build a poor man's DDNS solution for my home lab. My idea was a Telegram bot that I'd ask what the IP is, and it would respond with the current public IP of my behind-NAT router. I know, sounds insane, and I never did it. However, in the process, I got quite annoyed by how shitty most of the "what's my IP address" websites were, so I built my own one.

I was going to host it on #Vercel, and v1 was a #Go handler. I thought it was going to be fast, but the cold starts aren't very good on Vercel's free plan, so it was pretty slow.

v2 was the same idea, but repackaged as a JS function. It was a bit faster, but not by much, but I didn't care. It did what it needs to do, that's the important thing.

I am in the process of migrating my projects off GitHub and Vercel now. I was thinking about how I could run ip differently, how would I self-host it? Should it still be a #Node.js handler? Back to Go? And then, an idea struck me: Do I even need an app for that? Can't I do it one layer below?

Introducing: ip v3. Now it runs completely in #Caddy. There is no reverse proxy anywhere; Caddy just responds with the client IP immediately. I now self-host it on a cheap VPS, and it's incredibly fast. I now definitely know there is no tracking involved. And, the biggest thing—it now supports IPv6, while Vercel laughably does not. It's just better in every single way.

https://codeberg.org/kytta/ip

Makes me want to implement more stuff directly in Caddy

Zusammenfassungskarte des Repositorys kytta/ip
Codeberg.orgipA very simple endpoint to get your public IP address. Powered by Caddy
BotKit by Fedify :botkit:

We're excited to announce the release of BotKit 0.3.0! This release marks a significant milestone as #BotKit now supports #Node.js alongside #Deno, making it accessible to a wider audience. The minimum required Node.js version is 22.0.0. This dual-runtime support means you can now choose your preferred #JavaScript runtime while building #ActivityPub #bots with the same powerful BotKit APIs.

One of the most requested features has landed: poll support! You can now create interactive polls in your #bot messages, allowing followers to vote on questions with single or multiple-choice options. Polls are represented as ActivityPub Question objects with proper expiration times, and your bot can react to votes through the new onVote event handler. This feature enhances engagement possibilities and brings BotKit to feature parity with major #fediverse platforms like Mastodon and Misskey.

// Create a poll with multiple choices
await session.publish(text`What's your favorite programming language?`, {
  class: Question,
  poll: {
    multiple: true,  // Allow multiple selections
    options: ["JavaScript", "TypeScript", "Python", "Rust"],
    endTime: Temporal.Now.instant().add({ hours: 24 }),
  },
});

// Handle votes
bot.onVote = async (session, vote) => {
  console.log(`${vote.actor} voted for "${vote.option}"`);
};

The web frontend has been enhanced with a new followers page, thanks to the contribution from Hyeonseo Kim (@gaebalgom)! The /followers route now displays a paginated list of your bot's followers, and the follower count on the main profile page is now clickable, providing better visibility into your bot's audience. This improvement makes the web interface more complete and user-friendly.

For developers looking for alternative storage backends, we've introduced the SqliteRepository through the new @fedify/botkit-sqlite package. This provides a production-ready SQLite-based storage solution with ACID compliance, write-ahead logging (WAL) for optimal performance, and proper indexing. Additionally, the new @fedify/botkit/repository module offers MemoryCachedRepository for adding an in-memory cache layer on top of any repository implementation, improving read performance for frequently accessed data.

This release also includes an important security update: we've upgraded to #Fedify 1.8.8, ensuring your bots stay secure and compatible with the latest ActivityPub standards. The repository pattern has been expanded with new interfaces and types like RepositoryGetMessagesOptions, RepositoryGetFollowersOptions, and proper support for polls storage through the KvStoreRepositoryPrefixes.polls option, providing more flexibility for custom implementations.

#fedidev
AngesagtLive-Feeds
Über