🦄 Node.js Security

Command Injection intro, Node.js ESM dual support, Corepack core module outlook and StackBlitz new npm package release previewer

​A Brief Introduction to Command Injection Basics in Node.js​ — If you’re new to Command Injection, learn the basics of what this security vulnerability is about and the risks involved, referencing real-world incidents, and following best practices.

brief introduction to command injection in NodeJS

Headlines

​​Setting the standards for ESM and CJS​ — A conversation on the core Node.js repository with a proposal to provide best practices for publishing npm packages with ESM and CJS compatibility.

​​Is Corepack going away?​ — If you missed a small trivia detail on Node.js - it bundles corepack, a capability to manage package managers. Yep, you read that right. Should we remove it now from Node.js core? Join in on the ongoing conversation.

​​Learn Platformatic’s AI Warp to create OpenAI powered applications​ — This step-by-step guide goes through a React and Node.js application setup on-top of Platformatic new AI Warp scaffold project to build new GenAI powered applications with an OpenAI integration.

Platformatic also raises 4.3M đź’° in another funding round to address Node.js challenges. Congratulations to Matteo and Luca đź‘Ź.

​​Fastify published v5 with many updates 🎉

​​Test your packages before publishing with pkr.pr.new ​ — StackBlitz published a new toolchain to allow for preview releases of npm packages without releasing them to the npmjs registry.

pkg-pr-new from stackblitz

🧠 Pop quiz: is this code vulnerable to SQL injection? A good ​discussion​ on SQL syntax, abstraction, and the impact on security:

is this code vulnerable to SQL injection

📦 On npm

  • ​​vuln-regex-detector​​ — This module lets you check a regex for vulnerability. In JavaScript, regular expressions (regexes) can be “vulnerable”: susceptible to catastrophic backtracking. If your application is used on the client side, this can be a performance issue. On the server side, this can expose you to Regular Expression Denial of Service (ReDoS).

  • ​​git-secrets​​ — Prevents you from committing secrets and credentials into git repositories.

âť— New Security Vulnerabilities

đź”® Node.js Tip of the Week

New Node.js feature is experimental Node.js test runner capability

Now you can also include coverage reports using the Node.js native test runner with --experimental-test-coverage

node --experimental-test-coverage --test ./tests

code coverage in nodejs

đź’Ľ Hiring

Companies hiring for Node.js / JavaScript / TypeScript roles:

Node.js Security Newsletter

Subscribe to get everything in and around the Node.js security ecosystem, direct to your inbox.

    JavaScript & web security insights, latest security vulnerabilities, hands-on secure code insights, npm ecosystem incidents, Node.js runtime feature updates, Bun and Deno runtime updates, secure coding best practices, malware, malicious packages, and more.

    Built with ConvertKit