· 2 min read
How to securely build Docker images for Node.js
When a Dockerfile doesn't specify a USER directive, what's the worst that can happen?
The Blog
-
-
· 1 min read
Did you hear about the malicious backdoor discovered in the popular bootstrap-sass Ruby gem?
a malicious version of a Ruby gem used in a Rails application leads to remote code execution on vulnerable servers
-
· 29 min read
A Comprehensive Guide to Contract Testing APIs in a Service Oriented Architecture
It is likely you experienced the painful situation of deploying to production only to find out that an API service you integrate with has…
-
-
· 1 min read
So you think you're just gonna `npm install`? Think again
installing dependencies is not the same for development as it is for continuous integration systems, in this post I share why.
-
· 3 min read
How to avoid leaking secrets to the npm registry
10 awesome npm security tips to keep you safe!
-
· 4 min read
The State of — JSHeroes — 2019
The JSHeroes conference will take place this year in April and bring in people from all over the world to connect with new and old friends…
-
· 5 min read
Node.js Security WG — January 2019
In an effort to better promote and increase engagement in the Node.js Security WG we would like to share highlights more often, ideally…
-
· 7 min read
A Snyk’s Post-Mortem of the Malicious event-stream npm package backdoor
Last week the imaginable happened. A malicious package, flatmap-stream, was published to npm and was later added as a dependency to the…
-
· 2 min read
Fighting npm typosquatting attacks and naming rules for npm modules
I guess naming is a hard task in general, and for the npm registry, the naming rules have evolved from what they were to begin with, much…
-
· 4 min read
Demystifying Jest Async Testing Patterns
There are several traps that are easy to fall to when it comes to async testing. Moreover, there are several methods of achieving the same…
-
· 4 min read
Malicious Modules — what you need to know when installing npm packages
What if someone was able to directly publish a new vulnerable React version?
-
· 2 min read
What would you focus on when hiring engineering vp for a team of 10?
Let's assume you are tasked with hiring a VP Engineering for a relatively small team, say 10 engineers, which is on a growth trend as the company gets bigger.
-
· 5 min read
Reasons to Love Jest: The Developer Experience
Oh yes. The Developer Experience with Jest is transforming the act of writing tests from a chore to hell of a fun time, promise! 🤓
-
· 4 min read
Reasons to Love Jest: The Test Framework
We had Tape, Mocha, Ava, and now Jest. Let’s see what this is all about!
-
· 4 min read
Meet the Node.js Security Working Group
In this post I would like to acquaint you with the work being done by the Node.js Security Working Group (WG) and how we’re improving the…
-
· 4 min read
How a RegEx can bring your Node.js service down
The use of Regular Expressions (RegEx) is quite common among software engineers and DevOps or IT roles where they specify a string pattern…
-
· 1 min read
A suggested approach for your next project: RDD — README Driven Development
Side projects are an amazing thing.We learn, experiment, and collaborate with the world through them.
-
· 4 min read
Setting the platform with your team — A Manager’s README
A crucial part of being an engineering manager is on-boarding to a new team, or on-boarding others to yours. The important bits there is…
-
· 5 min read
Node.js — Integration Testing with Pact.js
In a previous article we reviewed how Consumer-Driven Contracts (CDC) help with integration testing in an environment that is rich with…
-
· 2 min read
💚 3 Valentine’s Poems for a Beloved & Secure Node.js App
Dedicated to everyone whom are helpless romantics as I am, and hopelessly in-love with their Node.js apps.
-
· 6 min read
Terrified of NPM security? please don’t blindly follow the panic
So you too panicked over security in the npm repository due to a recent blog post?
-
· 3 min read
Migrating a Mocha project to Jest Test Framework
I like mocha just like the next guy, but sometimes it’s time to move on. We’re talking about iced coffee, right?
-
· 1 min read
🔨 The long over-due commit of Open Source
This is a story of patience in Open Source, where every bug, every Pull-Request gets attention.
-
· 1 min read
The long over-due commit of Open Source
This is a story of patience in Open Source, where every bug, every Pull-Request gets attention.
