Loading video...

Video Failed to Load

There was a problem loading this video. This could be due to a temporary network issue or the video might be unavailable.

“Just use an npm package” Socket

Feross

41,212 subscribers

30,679 views • 3 months ago •via X (Twitter)

Science & Technology

Anya Rossi• Live Now

Private livecam show

2 Comments

小零3 months ago

@SocketSecurity 喜欢的话,我主页还有更多这种内容

Feross3 months ago

Source:

Related Videos

💥 Your AI coding assistant might be stealing your SSH keys. 💥 Socket found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.

💥 Your AI coding assistant might be stealing your SSH keys. 💥 Socket found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.

Feross

15,164 views • 8 months ago

1/4: 🚀 Big news from Socket! We're launching a new browser extension for Chrome, Firefox, Edge, & Brave. It helps you verify the security & trustworthiness of NPM packages before you install them. ✨ 👀 Let's see how it can help you avoid terrible NPM dependencies! 🗑️

1/4: 🚀 Big news from Socket! We're launching a new browser extension for Chrome, Firefox, Edge, & Brave. It helps you verify the security & trustworthiness of NPM packages before you install them. ✨ 👀 Let's see how it can help you avoid terrible NPM dependencies! 🗑️

Feross

14,377 views • 3 years ago

The `xz` package backdoor is just the tip of the iceberg. There's a CONSTANT low-level stream of malware and spyware being uploaded to npm, PyPI, and Go registries. I want to share a few examples from the 20,000+ malicious packages we detected so far:

The `xz` package backdoor is just the tip of the iceberg. There's a CONSTANT low-level stream of malware and spyware being uploaded to npm, PyPI, and Go registries. I want to share a few examples from the 20,000+ malicious packages we detected so far:

Feross

303,064 views • 2 years ago

I'm an engineer. I used to think sales was dirty. Cold calls, pushy tactics, all of it. The product should speak for itself. Running Socket changed my mind. I actually like sales now. Done well, sales is consultative. You help people understand a problem that matters, you're honest about where your product is strong and where it isn't, and you optimize for fit. That's not in tension with the engineering mindset. It's an extension of it. There are two ways to die as a company. Build a technically excellent product that nobody cares about. Or put sales in charge, underinvest in engineering, grow fast, and hit a ceiling when customers realize the product hasn't improved in five years. We've watched competitors do the second. The job is to keep engineering and sales both strong, and never let one dominate the other. I joined Anne Dwane on the Village Global podcast to talk about this, plus where Socket is today and why open source supply chain risk keeps getting worse. Full episode in the comments.

I'm an engineer. I used to think sales was dirty. Cold calls, pushy tactics, all of it. The product should speak for itself. Running Socket changed my mind. I actually like sales now. Done well, sales is consultative. You help people understand a problem that matters, you're honest about where your product is strong and where it isn't, and you optimize for fit. That's not in tension with the engineering mindset. It's an extension of it. There are two ways to die as a company. Build a technically excellent product that nobody cares about. Or put sales in charge, underinvest in engineering, grow fast, and hit a ceiling when customers realize the product hasn't improved in five years. We've watched competitors do the second. The job is to keep engineering and sales both strong, and never let one dominate the other. I joined Anne Dwane on the Village Global podcast to talk about this, plus where Socket is today and why open source supply chain risk keeps getting worse. Full episode in the comments.

Feross

13,243 views • 3 months ago

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"

Sawyer Hood

871,559 views • 7 months ago

Claude Code: "npm add ..." You: "Use pnpm, you idiot!" *adds it to CLAUDE.md* Claude: "npm add ..." There's a better way:

Claude Code: "npm add ..." You: "Use pnpm, you idiot!" adds it to CLAUDE.md Claude: "npm add ..." There's a better way:

Matt Pocock

150,166 views • 8 months ago

👾#XRP hack breakdown xrpl NPM package injected with key-stealing malware. Versions 4.2.4–2.14.2 hit. Compromised via dev NPM access token Caught early by Aikido Sign & verify your releases, folks! 🛡️ #InfoSec #SupplyChainAttack #xrpl

👾#XRP hack breakdown xrpl NPM package injected with key-stealing malware. Versions 4.2.4–2.14.2 hit. Compromised via dev NPM access token Caught early by Aikido Sign & verify your releases, folks! 🛡️ #InfoSec #SupplyChainAttack #xrpl

Mackenzie Jackson -

13,877 views • 1 year ago

Here's the first 3 minutes of how I'd publish a package to npm in 2024. Full video coming this week.

Here's the first 3 minutes of how I'd publish a package to npm in 2024. Full video coming this week.

Matt Pocock

42,692 views • 2 years ago

Introducing ▲ Streamdown A drop-in replacement for react-markdown, designed for AI-powered streaming. npm i streamdown (or just use AI Elements!) Link 👇

Introducing ▲ Streamdown A drop-in replacement for react-markdown, designed for AI-powered streaming. npm i streamdown (or just use AI Elements!) Link 👇

Hayden

101,710 views • 1 year ago

Vibe-coded prototypes get thrown away because they don’t use your design system code. Bolt’s Design System Agents fix this: - Upload your npm package, Storybook, repo, etc - Bolt builds using your design system - Engineering wires up the backend and ships

Vibe-coded prototypes get thrown away because they don’t use your design system code. Bolt’s Design System Agents fix this: - Upload your npm package, Storybook, repo, etc - Bolt builds using your design system - Engineering wires up the backend and ships

bolt.new

14,468 views • 7 months ago

You can quickly try different package managers in your repo with one simple script: `npx @turbo/workspaces convert` ◆ Handles lockfiles, node_modules, and workspace descriptors ◆ npm, yarn, and pnpm support ◆ Works for single and multi-package workspaces

You can quickly try different package managers in your repo with one simple script: `npx @turbo/workspaces convert` ◆ Handles lockfiles, node_modules, and workspace descriptors ◆ npm, yarn, and pnpm support ◆ Works for single and multi-package workspaces

Anthony Shew

27,952 views • 2 years ago

The below video is real. No cuts. Founders + CTOs use this, and comapre it to Cursor + Claude Artifacts but prefer it because: - you can edit the code in your favorite IDE (two-way github sync) - automatically knows what npm package to use - picks up errors and fixes them - fast (built with rust)

The below video is real. No cuts. Founders + CTOs use this, and comapre it to Cursor + Claude Artifacts but prefer it because: - you can edit the code in your favorite IDE (two-way github sync) - automatically knows what npm package to use - picks up errors and fixes them - fast (built with rust)

Anton Osika

453,622 views • 2 years ago

Saw Aaryan gooey toast concept (via Ali Bey) and thought "I need this now!" 😩 So I vibed code it overnight and shipped it as an npm package goey-toast — morphing toast notifications for React - Organic pill → blob → pill animations - Promise toasts with loading → success/error - Action buttons, custom styling, full API - Built on Sonner + Framer Motion npm install goey-toast Demo & docs: GitHub:

Saw Aaryan gooey toast concept (via Ali Bey) and thought "I need this now!" 😩 So I vibed code it overnight and shipped it as an npm package goey-toast — morphing toast notifications for React - Organic pill → blob → pill animations - Promise toasts with loading → success/error - Action buttons, custom styling, full API - Built on Sonner + Framer Motion npm install goey-toast Demo & docs: GitHub:

Alfredo Natal

49,954 views • 8 months ago

Vite+ shipped under MIT! 🎉 And the unified frontend toolchain now also has Bun support as package manager, in addition to existing pnpm, Yarn, and npm support.

Vite+ shipped under MIT! 🎉 And the unified frontend toolchain now also has Bun support as package manager, in addition to existing pnpm, Yarn, and npm support.

VoidZero

13,472 views • 6 months ago

25 loading buttons, open-source animated motion collection 13 webgl, svg/canvas/css, responsive, replayable, zero dependencies comment "LOADER" and i'll send you the npm + react native package

25 loading buttons, open-source animated motion collection 13 webgl, svg/canvas/css, responsive, replayable, zero dependencies comment "LOADER" and i'll send you the npm + react native package

jaimin

63,282 views • 3 months ago

Successefull use of film and package tape.

Sensitive content

Successefull use of film and package tape.

LustTek

189,693 views • 5 months ago

SOMEONE MADE IT SO YOU CAN CODE WITH 174 AI MODELS FROM 23 PROVIDERS FOR FREE one npm package and one install: "npm i -g free-coding-models" switch between any model instantly. benchmark them against each other in real time to see which one actually codes best for your use case. no subscriptions. no API keys. no cost. 174 models. 23 providers, all free, all from your terminal. if you're tired of paying for 3 different AI subscriptions just to compare which model codes better, this is it

SOMEONE MADE IT SO YOU CAN CODE WITH 174 AI MODELS FROM 23 PROVIDERS FOR FREE one npm package and one install: "npm i -g free-coding-models" switch between any model instantly. benchmark them against each other in real time to see which one actually codes best for your use case. no subscriptions. no API keys. no cost. 174 models. 23 providers, all free, all from your terminal. if you're tired of paying for 3 different AI subscriptions just to compare which model codes better, this is it

Om Patel

93,660 views • 7 months ago