Video wird geladen...

Video konnte nicht geladen werden

Zur Startseite

“Just use an npm package” Socket

feross's profile picture

Feross

41,212 subscribers

30,679 Aufrufe • vor 3 Monaten •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

2 Kommentare

Profilbild von 小零
小零vor 3 Monaten

@SocketSecurity 喜欢的话,我主页还有更多这种内容

Profilbild von Feross
Ferossvor 3 Monaten

Source:

Ähnliche Videos

💥 Your AI coding assistant might be stealing your SSH keys. 💥 Socket found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.
2:50

💥 Your AI coding assistant might be stealing your SSH keys. 💥 Socket found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.

Feross

15,164 Aufrufe • vor 8 Monaten

1/4: 🚀 Big news from Socket! We're launching a new browser extension for Chrome, Firefox, Edge, & Brave. It helps you verify the security & trustworthiness of NPM packages before you install them. ✨ 👀 Let's see how it can help you avoid terrible NPM dependencies! 🗑️
6:46

1/4: 🚀 Big news from Socket! We're launching a new browser extension for Chrome, Firefox, Edge, & Brave. It helps you verify the security & trustworthiness of NPM packages before you install them. ✨ 👀 Let's see how it can help you avoid terrible NPM dependencies! 🗑️

Feross

14,377 Aufrufe • vor 3 Jahren

The `xz` package backdoor is just the tip of the iceberg. There's a CONSTANT low-level stream of malware and spyware being uploaded to npm, PyPI, and Go registries. I want to share a few examples from the 20,000+ malicious packages we detected so far:
19:01

The `xz` package backdoor is just the tip of the iceberg. There's a CONSTANT low-level stream of malware and spyware being uploaded to npm, PyPI, and Go registries. I want to share a few examples from the 20,000+ malicious packages we detected so far:

Feross

303,064 Aufrufe • vor 2 Jahren

I'm an engineer. I used to think sales was dirty. Cold calls, pushy tactics, all of it. The product should speak for itself. Running Socket changed my mind. I actually like sales now. Done well, sales is consultative. You help people understand a problem that matters, you're honest about where your product is strong and where it isn't, and you optimize for fit. That's not in tension with the engineering mindset. It's an extension of it. There are two ways to die as a company. Build a technically excellent product that nobody cares about. Or put sales in charge, underinvest in engineering, grow fast, and hit a ceiling when customers realize the product hasn't improved in five years. We've watched competitors do the second. The job is to keep engineering and sales both strong, and never let one dominate the other. I joined Anne Dwane on the Village Global podcast to talk about this, plus where Socket is today and why open source supply chain risk keeps getting worse. Full episode in the comments.
1:57

I'm an engineer. I used to think sales was dirty. Cold calls, pushy tactics, all of it. The product should speak for itself. Running Socket changed my mind. I actually like sales now. Done well, sales is consultative. You help people understand a problem that matters, you're honest about where your product is strong and where it isn't, and you optimize for fit. That's not in tension with the engineering mindset. It's an extension of it. There are two ways to die as a company. Build a technically excellent product that nobody cares about. Or put sales in charge, underinvest in engineering, grow fast, and hit a ceiling when customers realize the product hasn't improved in five years. We've watched competitors do the second. The job is to keep engineering and sales both strong, and never let one dominate the other. I joined Anne Dwane on the Village Global podcast to talk about this, plus where Socket is today and why open source supply chain risk keeps getting worse. Full episode in the comments.

Feross

13,243 Aufrufe • vor 3 Monaten

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"
0:30

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"

Sawyer Hood

871,559 Aufrufe • vor 7 Monaten

Claude Code: "npm add ..." You: "Use pnpm, you idiot!" *adds it to CLAUDE​.md* Claude: "npm add ..." There's a better way:
6:50

Claude Code: "npm add ..." You: "Use pnpm, you idiot!" *adds it to CLAUDE​.md* Claude: "npm add ..." There's a better way:

Matt Pocock

150,166 Aufrufe • vor 8 Monaten

👾#XRP hack breakdown xrpl NPM package injected with key-stealing malware. Versions 4.2.4–2.14.2 hit. Compromised via dev NPM access token Caught early by Aikido Sign & verify your releases, folks! 🛡️ #InfoSec #SupplyChainAttack #xrpl
7:48

👾#XRP hack breakdown xrpl NPM package injected with key-stealing malware. Versions 4.2.4–2.14.2 hit. Compromised via dev NPM access token Caught early by Aikido Sign & verify your releases, folks! 🛡️ #InfoSec #SupplyChainAttack #xrpl

Mackenzie Jackson -

13,877 Aufrufe • vor 1 Jahr

Here's the first 3 minutes of how I'd publish a package to npm in 2024. Full video coming this week.
2:57

Here's the first 3 minutes of how I'd publish a package to npm in 2024. Full video coming this week.

Matt Pocock

42,692 Aufrufe • vor 2 Jahren

Introducing ▲ Streamdown A drop-in replacement for react-markdown, designed for AI-powered streaming. npm i streamdown (or just use AI Elements!) Link 👇
2:20

Introducing ▲ Streamdown A drop-in replacement for react-markdown, designed for AI-powered streaming. npm i streamdown (or just use AI Elements!) Link 👇

Hayden

101,646 Aufrufe • vor 1 Jahr

Vibe-coded prototypes get thrown away because they don’t use your design system code. Bolt’s Design System Agents fix this: - Upload your npm package, Storybook, repo, etc - Bolt builds using your design system - Engineering wires up the backend and ships
3:10

Vibe-coded prototypes get thrown away because they don’t use your design system code. Bolt’s Design System Agents fix this: - Upload your npm package, Storybook, repo, etc - Bolt builds using your design system - Engineering wires up the backend and ships

bolt.new

14,390 Aufrufe • vor 7 Monaten

The below video is real. No cuts. Founders + CTOs use this, and comapre it to Cursor + Claude Artifacts but prefer it because: - you can edit the code in your favorite IDE (two-way github sync) - automatically knows what npm package to use - picks up errors and fixes them - fast (built with rust)
1:47

The below video is real. No cuts. Founders + CTOs use this, and comapre it to Cursor + Claude Artifacts but prefer it because: - you can edit the code in your favorite IDE (two-way github sync) - automatically knows what npm package to use - picks up errors and fixes them - fast (built with rust)

Anton Osika

453,622 Aufrufe • vor 2 Jahren

You can quickly try different package managers in your repo with one simple script: `npx @turbo/workspaces convert` ◆ Handles lockfiles, node_modules, and workspace descriptors ◆ npm, yarn, and pnpm support ◆ Works for single and multi-package workspaces
1:30

You can quickly try different package managers in your repo with one simple script: `npx @turbo/workspaces convert` ◆ Handles lockfiles, node_modules, and workspace descriptors ◆ npm, yarn, and pnpm support ◆ Works for single and multi-package workspaces

Anthony Shew

27,952 Aufrufe • vor 2 Jahren

Saw Aaryan gooey toast concept (via Ali Bey) and thought "I need this now!" 😩 So I vibed code it overnight and shipped it as an npm package goey-toast — morphing toast notifications for React - Organic pill → blob → pill animations - Promise toasts with loading → success/error - Action buttons, custom styling, full API - Built on Sonner + Framer Motion npm install goey-toast Demo & docs: GitHub:
0:27

Saw Aaryan gooey toast concept (via Ali Bey) and thought "I need this now!" 😩 So I vibed code it overnight and shipped it as an npm package goey-toast — morphing toast notifications for React - Organic pill → blob → pill animations - Promise toasts with loading → success/error - Action buttons, custom styling, full API - Built on Sonner + Framer Motion npm install goey-toast Demo & docs: GitHub:

Alfredo Natal

49,954 Aufrufe • vor 8 Monaten

Vite+ shipped under MIT! 🎉 And the unified frontend toolchain now also has Bun support as package manager, in addition to existing pnpm, Yarn, and npm support.
0:57

Vite+ shipped under MIT! 🎉 And the unified frontend toolchain now also has Bun support as package manager, in addition to existing pnpm, Yarn, and npm support.

VoidZero

13,472 Aufrufe • vor 6 Monaten

25 loading buttons, open-source animated motion collection 13 webgl, svg/canvas/css, responsive, replayable, zero dependencies comment "LOADER" and i'll send you the npm + react native package
0:34

25 loading buttons, open-source animated motion collection 13 webgl, svg/canvas/css, responsive, replayable, zero dependencies comment "LOADER" and i'll send you the npm + react native package

jaimin

63,138 Aufrufe • vor 2 Monaten

Successefull use of film and package tape.
1:30

Sensitive content

Successefull use of film and package tape.

LustTek

189,457 Aufrufe • vor 5 Monaten

SOMEONE MADE IT SO YOU CAN CODE WITH 174 AI MODELS FROM 23 PROVIDERS FOR FREE one npm package and one install: "npm i -g free-coding-models" switch between any model instantly. benchmark them against each other in real time to see which one actually codes best for your use case. no subscriptions. no API keys. no cost. 174 models. 23 providers, all free, all from your terminal. if you're tired of paying for 3 different AI subscriptions just to compare which model codes better, this is it
2:55

SOMEONE MADE IT SO YOU CAN CODE WITH 174 AI MODELS FROM 23 PROVIDERS FOR FREE one npm package and one install: "npm i -g free-coding-models" switch between any model instantly. benchmark them against each other in real time to see which one actually codes best for your use case. no subscriptions. no API keys. no cost. 174 models. 23 providers, all free, all from your terminal. if you're tired of paying for 3 different AI subscriptions just to compare which model codes better, this is it

Om Patel

93,660 Aufrufe • vor 7 Monaten