# Blog — Page 8 — Liran Tal AI security researcher, open-source maintainer, and author. Explore Liran Tal’s blog, research papers, developer tools, books, and conference talks. Canonical: https://lirantal.com/blog/8 * Apr 22, 2019 · 2 min read ## [How to securely build Docker images for Node.js](/blog/2019-04-22-securely-build-docker-images) When a Dockerfile doesn't specify a USER directive, what's the worst that can happen? [![](/_astro/photo-1578163677454-b3933804a354.Zqy-MEOP_Z1vSfLK.jpg)](/blog/2019-04-22-securely-build-docker-images) * Apr 9, 2019 · 1 min read ## [Did you hear about the malicious backdoor discovered in the popular bootstrap-sass Ruby gem?](/blog/2019-04-09_the-malicious-backdoor-of-ruby) a malicious version of a Ruby gem used in a Rails application leads to remote code execution on vulnerable servers [![](/_astro/photo-1510920081567-0c22e967d744.BJyjYi9n_ZAqLpN.jpg)](/blog/2019-04-09_the-malicious-backdoor-of-ruby) * Mar 28, 2019 · 29 min read ## [A Comprehensive Guide to Contract Testing APIs in a Service Oriented Architecture](/blog/a-comprehensive-guide-to-contract-testing-apis-in-a-service-oriented-architecture-5695ccf9ac5a) It is likely you experienced the painful situation of deploying to production only to find out that an API service you integrate with has… [![](/_astro/d3d84d93effb64a352b87d2acb9594ee.Dx0lSvj__Z2hQKfS.jpg)](/blog/a-comprehensive-guide-to-contract-testing-apis-in-a-service-oriented-architecture-5695ccf9ac5a) * Mar 18, 2019 · 2 min read ## [Assess your npm project health and call the doctor!](/blog/2019-03-18_assess-your-npm-project-health) npm project health assessment [![](/_astro/photo-1614154761029-f8e6c693bae8.m3gVZ-wr_Z2bP5LR.jpg)](/blog/2019-03-18_assess-your-npm-project-health) * Mar 11, 2019 · 1 min read ## [So you think you're just gonna \`npm install\`? Think again](/blog/2019-03-10_so-you-think-you-can-npm-install) installing dependencies is not the same for development as it is for continuous integration systems, in this post I share why. [![](/_astro/photo-1465788786008-f75a725b34e9.BHn--sUc_nzKj5.jpg)](/blog/2019-03-10_so-you-think-you-can-npm-install) * Mar 5, 2019 · 3 min read ## [How to avoid leaking secrets to the npm registry](/blog/2019-03-05_avoid-leaking-secrets-to-npm-registry) 10 awesome npm security tips to keep you safe! [![](/_astro/photo-1542320868-5ded2628008a.2Jo3URlm_Z2mgGUp.jpg)](/blog/2019-03-05_avoid-leaking-secrets-to-npm-registry) * Feb 7, 2019 · 4 min read ## [The State of — JSHeroes — 2019](/blog/the-state-of-jsheroes-2019-b9714420e44f) The JSHeroes conference will take place this year in April and bring in people from all over the world to connect with new and old friends… [![](/_astro/6be7577b7d1a0ed6b3a0a36c72c91e14.DhAIxt5D_NVCYO.jpg)](/blog/the-state-of-jsheroes-2019-b9714420e44f) * Jan 11, 2019 · 5 min read ## [Node.js Security WG — January 2019](/blog/node-js-security-wg-january-2019-619ef804cd6d) In an effort to better promote and increase engagement in the Node.js Security WG we would like to share highlights more often, ideally… [![](/_astro/cc1fafc5281c59bdf6d9d34274ea4b4c.CV0LtGE9_BcUGG.jpg)](/blog/node-js-security-wg-january-2019-619ef804cd6d) * Dec 6, 2018 · 7 min read ## [A Snyk’s Post-Mortem of the Malicious event-stream npm package backdoor](/blog/a-snyks-post-mortem-of-the-malicious-event-stream-npm-package-backdoor-40be813022bb) Last week the imaginable happened. A malicious package, flatmap-stream, was published to npm and was later added as a dependency to the… [![](/_astro/f4c8af6beb8aa370076153cf5c409e86.DkWFijSm_Z26OL3y.jpg)](/blog/a-snyks-post-mortem-of-the-malicious-event-stream-npm-package-backdoor-40be813022bb) * Sep 18, 2018 · 2 min read ## [Fighting npm typosquatting attacks and naming rules for npm modules](/blog/fighting-npm-typosquatting-attacks-and-naming-rules-for-npm-modules-a0b7a86344aa) I guess naming is a hard task in general, and for the npm registry, the naming rules have evolved from what they were to begin with, much… [![](/_astro/25dbf50769d3674e1c087232e7e60148.BVbZE5-P_Z1e1dKs.jpg)](/blog/fighting-npm-typosquatting-attacks-and-naming-rules-for-npm-modules-a0b7a86344aa) * Aug 9, 2018 · 4 min read ## [Demystifying Jest Async Testing Patterns](/blog/demystifying-jest-async-testing-patterns-b730d4cca4ec) There are several traps that are easy to fall to when it comes to async testing. Moreover, there are several methods of achieving the same… [![](/_astro/31e1d4ae0b2a4bfcaa29bd0fd94fbd2b.CSYwYSqx_Z28Pw8V.jpg)](/blog/demystifying-jest-async-testing-patterns-b730d4cca4ec) * Jul 17, 2018 · 4 min read ## [Malicious Modules — what you need to know when installing npm packages](/blog/malicious-modules-what-you-need-to-know-when-installing-npm-packages-12b2f56d3685) What if someone was able to directly publish a new vulnerable React version? [![](/_astro/c4a0a36699be4bafe82424cff04faa48.VBOy2YbX_ZOKJ50.jpg)](/blog/malicious-modules-what-you-need-to-know-when-installing-npm-packages-12b2f56d3685) * Jul 1, 2018 · 2 min read ## [What would you focus on when hiring engineering vp for a team of 10?](/blog/2018-06-31_engineering-managment) Let's assume you are tasked with hiring a VP Engineering for a relatively small team, say 10 engineers, which is on a growth trend as the company gets bigger. [![](/_astro/photo-1616646131606-473894f0fed9.fK7hN5T7_2vuQft.jpg)](/blog/2018-06-31_engineering-managment) * Jun 28, 2018 · 5 min read ## [Reasons to Love Jest: The Developer Experience](/blog/reasons-to-love-jest-the-developer-experience-b00ec93df7bb) Oh yes. The Developer Experience with Jest is transforming the act of writing tests from a chore to hell of a fun time, promise! 🤓 [![](/_astro/92df734d2f1ca2383f3a3c5f2d71831f.LCo88lnf_GpLwe.jpg)](/blog/reasons-to-love-jest-the-developer-experience-b00ec93df7bb) * Jun 20, 2018 · 4 min read ## [Reasons to Love Jest: The Test Framework](/blog/reasons-to-love-jest-the-test-framework-ae19b49c02c3) We had Tape, Mocha, Ava, and now Jest. Let’s see what this is all about! [![](/_astro/baab37c6065e3102060f5dcb9c20cc75.4vgX7JET_Z3jHuY.jpg)](/blog/reasons-to-love-jest-the-test-framework-ae19b49c02c3) * May 31, 2018 · 4 min read ## [Meet the Node.js Security Working Group](/blog/meet-the-node-js-security-working-group-30b9f00b678) In this post I would like to acquaint you with the work being done by the Node.js Security Working Group (WG) and how we’re improving the… [![](/_astro/8f6b8d1eeaf7044d229dfe923f1b15f1.BAVcDAeM_ZvXzUC.jpg)](/blog/meet-the-node-js-security-working-group-30b9f00b678) * May 14, 2018 · 4 min read ## [How a RegEx can bring your Node.js service down](/blog/node-js-pitfalls-how-a-regex-can-bring-your-system-down-cbf1dc6c4e02) The use of Regular Expressions (RegEx) is quite common among software engineers and DevOps or IT roles where they specify a string pattern… [![](/_astro/36c3fb5fd13b4fe7a423bdb4f2323597.BgM_0AX3_usdPr.jpg)](/blog/node-js-pitfalls-how-a-regex-can-bring-your-system-down-cbf1dc6c4e02) * Apr 28, 2018 · 1 min read ## [A suggested approach for your next project: RDD — README Driven Development](/blog/a-suggested-approach-for-your-next-project-rdd-readme-driven-development-5fc64c7845db) Side projects are an amazing thing.We learn, experiment, and collaborate with the world through them. [![](/_astro/5306423eb4e1bb2d85a4559bcd0aa319.TR_VuYFN_ZyFnQl.jpg)](/blog/a-suggested-approach-for-your-next-project-rdd-readme-driven-development-5fc64c7845db) * Apr 4, 2018 · 4 min read ## [Setting the platform with your team — A Manager’s README](/blog/setting-the-platform-with-your-team-a-managers-readme-32764bbc8455) A crucial part of being an engineering manager is on-boarding to a new team, or on-boarding others to yours. The important bits there is… [![](/_astro/7deb2e9093e5c4505ead7b0597163b2b.D18eh7dz_1tqT5B.jpg)](/blog/setting-the-platform-with-your-team-a-managers-readme-32764bbc8455) * Mar 5, 2018 · 5 min read ## [Node.js — Integration Testing with Pact.js](/blog/node-js-integration-testing-with-pact-js-1a2ea8aa3116) In a previous article we reviewed how Consumer-Driven Contracts (CDC) help with integration testing in an environment that is rich with… [![](/_astro/8c3b6a5fb6a0020f4c4e53cc4f46b3ac.DOQoZCrz_Z1FCQ2V.jpg)](/blog/node-js-integration-testing-with-pact-js-1a2ea8aa3116) * Feb 16, 2018 · 2 min read ## [💚 3 Valentine’s Poems for a Beloved & Secure Node.js App](/blog/3-valentines-poems-for-a-beloved-secure-node-js-app-bc9dc27dca00) Dedicated to everyone whom are helpless romantics as I am, and hopelessly in-love with their Node.js apps. [![](/_astro/c56b1e2bd1b3b1bf3929b78af3b8143e.6ZL0EGrO_Z5dAmC.jpg)](/blog/3-valentines-poems-for-a-beloved-secure-node-js-app-bc9dc27dca00) * Jan 7, 2018 · 6 min read ## [Terrified of NPM security? please don’t blindly follow the panic](/blog/npm-security-please-dont-blindly-follow-the-panic-f724871ba1a8) So you too panicked over security in the npm repository due to a recent blog post? [![](/_astro/bb14cb0f93730f9b142e495d8609e03b.DB08gTx3_Z2lmHYt.jpg)](/blog/npm-security-please-dont-blindly-follow-the-panic-f724871ba1a8) * Nov 26, 2017 · 3 min read ## [Migrating a Mocha project to Jest Test Framework](/blog/migrating-a-mocha-project-to-jest-test-framework-76d13d76685) I like mocha just like the next guy, but sometimes it’s time to move on. We’re talking about iced coffee, right? [![](/_astro/f5843d654b6a262e729aa81fd2468f5c.CPyIlryI_ZH3xED.jpg)](/blog/migrating-a-mocha-project-to-jest-test-framework-76d13d76685) * Oct 9, 2017 · 1 min read ## [🔨 The long over-due commit of Open Source](/blog/the-long-over-due-commit-of-open-source-a08337438a29) This is a story of patience in Open Source, where every bug, every Pull-Request gets attention. [![](/_astro/e8cd353df37067f2a775527fb689a981.3LWZ1zmI_Z1NVEjk.jpg)](/blog/the-long-over-due-commit-of-open-source-a08337438a29) * Oct 9, 2017 · 1 min read ## [The long over-due commit of Open Source](/blog/2017-10-09_the-long-overdue-commit-of-opensource) This is a story of patience in Open Source, where every bug, every Pull-Request gets attention. [![](/_astro/photo-1516849841032-87cbac4d88f7.B80S4ox-_d7spK.jpg)](/blog/2017-10-09_the-long-overdue-commit-of-opensource) [ Newer posts ](/blog/7)[ Older posts ](/blog/9)