Making "safe npm"

JS Party: JavaScript, CSS, Web Development

Player FM - Internet Radio Done Right

1,026 subscribers

JavaScript

הוסף לפני eight שנים

תוכן מסופק על ידי Changelog Media. כל תוכן הפודקאסטים כולל פרקים, גרפיקה ותיאורי פודקאסטים מועלים ומסופקים ישירות על ידי Changelog Media או שותף פלטפורמת הפודקאסט שלהם. אם אתה מאמין שמישהו משתמש ביצירה שלך המוגנת בזכויות יוצרים ללא רשותך, אתה יכול לעקוב אחר התהליך המתואר כאן https://he.player.fm/legal.

<div class="span index">1</div> <span><a class="" data-remote="true" data-type="html" href="/series/the-final-flight-of-captain-forrester">The Final Flight of Captain Forrester</a></span>

1
The Final Flight of Captain Forrester

בטל רישום

לפני 1 dayלפני 1d ago

בטל רישום

חודשי

A woman’s search for her father—a pilot who disappeared during a mission in Vietnam—collides with the fight over what we owe those who never returned from war. From the producers of "America's Girls," and hosted by Texas Monthly writer Josh Alvarez, the show debuts April 2025. Texas Monthly Audio subscribers get early access to the show, plus bonus episodes and more subscriber-only audio. Visit texasmonthly.com/audio to learn more.

לפני שנתיים 1:02:06

MP3•בית הפרקים

Feross and his team at Socket recently shipped a wrapper library for the ubiquitous npm package manager’s command-line interface that brings enhanced security when you need it most: before executing any code

Bradly Farias lead this effort, so Jerod & Chris invited him on the show to learn all about it.

Join the discussion

Changelog++ members save 3 minutes on this episode because they made the ads disappear. Join today!

Sponsors:

Fastly – Our bandwidth partner. Fastly powers fast, secure, and scalable digital experiences. Move beyond your content delivery network to their powerful edge cloud platform. Learn more at fastly.com
Fly.io – The home of Changelog.com — Deploy your apps and databases close to your users. In minutes you can run your Ruby, Go, Node, Deno, Python, or Elixir app (and databases!) all over the world. No ops required. Learn more at fly.io/changelog and check out the speedrun in their docs.
Changelog News – A podcast+newsletter combo that’s brief, entertaining & always on-point. Subscribe today.
KBall Coaching – Free exploratory coaching sessions from JS Party co-host KBall! Click here to get started

Featuring:

Bradley Meck Farias – GitHub, LinkedIn, Mastodon, X
Jerod Santo – GitHub, LinkedIn, Mastodon, X
Feross Aboukhadijeh – Website, GitHub, X
Christopher Hiller – Website, GitHub, Mastodon, X

Show Notes:

Something missing or broken? PRs welcome!

פרקים

1. It's party time, y'all (00:00:00)

2. Welcoming Bradley to the pod (00:01:03)

3. Intro to "safe npm" (00:02:20)

4. Socket in your CLI (00:05:08)

5. Devs care about different things (00:11:08)

6. Appetite for disruption (00:12:12)

7. What we want vs what we need (00:14:15)

8. Sponsor: Changelog News (00:19:43)

https://changelog.com/news

9. Building an npm wrapper (00:20:43)

10. Open source & security concerns (00:30:51)

11. Sponsor: KBall Coaching (00:35:02)

https://www.kball.llc/coaching

12. Using the npm wrapper (00:35:44)

13. Working with yarn (00:37:27)

14. npm uninstall installs stuff?! (00:40:14)

15. How Socket deals with this (00:43:32)

16. Is it vendoring npm or no? (00:45:04)

17. Windows (non) support (00:46:56)

18. What's next (00:50:21)

19. Wrapping up (00:53:50)

20. Next up on the pod (00:54:12)

https://changelog.com/++

21. ++BONUS FOR ALL (00:55:31)