Loading video...

Video Failed to Load

Go Home

“Just use an npm package” Socket

feross's profile picture

Feross

41,259 subscribers

30,661 views • 1 month ago •via X (Twitter)

LIVE

Anya Rossi• Live Now

Private livecam show

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

1/4: 🚀 Big news from Socket! We're launching a new browser extension for Chrome, Firefox, Edge, & Brave. It helps you verify the security & trustworthiness of NPM packages before you install them. ✨ 👀 Let's see how it can help you avoid terrible NPM dependencies! 🗑️
6:46

1/4: 🚀 Big news from Socket! We're launching a new browser extension for Chrome, Firefox, Edge, & Brave. It helps you verify the security & trustworthiness of NPM packages before you install them. ✨ 👀 Let's see how it can help you avoid terrible NPM dependencies! 🗑️

Feross

14,377 views • 3 years ago

💥 Your AI coding assistant might be stealing your SSH keys. 💥 Socket found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.
2:50

💥 Your AI coding assistant might be stealing your SSH keys. 💥 Socket found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.

Feross

15,164 views • 6 months ago

The `xz` package backdoor is just the tip of the iceberg. There's a CONSTANT low-level stream of malware and spyware being uploaded to npm, PyPI, and Go registries. I want to share a few examples from the 20,000+ malicious packages we detected so far:
19:01

The `xz` package backdoor is just the tip of the iceberg. There's a CONSTANT low-level stream of malware and spyware being uploaded to npm, PyPI, and Go registries. I want to share a few examples from the 20,000+ malicious packages we detected so far:

Feross

303,002 views • 2 years ago

I'm an engineer. I used to think sales was dirty. Cold calls, pushy tactics, all of it. The product should speak for itself. Running Socket changed my mind. I actually like sales now. Done well, sales is consultative. You help people understand a problem that matters, you're honest about where your product is strong and where it isn't, and you optimize for fit. That's not in tension with the engineering mindset. It's an extension of it. There are two ways to die as a company. Build a technically excellent product that nobody cares about. Or put sales in charge, underinvest in engineering, grow fast, and hit a ceiling when customers realize the product hasn't improved in five years. We've watched competitors do the second. The job is to keep engineering and sales both strong, and never let one dominate the other. I joined Anne Dwane on the Village Global podcast to talk about this, plus where Socket is today and why open source supply chain risk keeps getting worse. Full episode in the comments.
1:57

I'm an engineer. I used to think sales was dirty. Cold calls, pushy tactics, all of it. The product should speak for itself. Running Socket changed my mind. I actually like sales now. Done well, sales is consultative. You help people understand a problem that matters, you're honest about where your product is strong and where it isn't, and you optimize for fit. That's not in tension with the engineering mindset. It's an extension of it. There are two ways to die as a company. Build a technically excellent product that nobody cares about. Or put sales in charge, underinvest in engineering, grow fast, and hit a ceiling when customers realize the product hasn't improved in five years. We've watched competitors do the second. The job is to keep engineering and sales both strong, and never let one dominate the other. I joined Anne Dwane on the Village Global podcast to talk about this, plus where Socket is today and why open source supply chain risk keeps getting worse. Full episode in the comments.

Feross

13,206 views • 1 month ago

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"
0:30

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"

Sawyer Hood

869,999 views • 5 months ago

Claude Code: "npm add ..." You: "Use pnpm, you idiot!" *adds it to CLAUDE​.md* Claude: "npm add ..." There's a better way:
6:50

Claude Code: "npm add ..." You: "Use pnpm, you idiot!" *adds it to CLAUDE​.md* Claude: "npm add ..." There's a better way:

Matt Pocock

150,166 views • 6 months ago

Here's the first 3 minutes of how I'd publish a package to npm in 2024. Full video coming this week.
2:57

Here's the first 3 minutes of how I'd publish a package to npm in 2024. Full video coming this week.

Matt Pocock

42,692 views • 2 years ago

👾#XRP hack breakdown xrpl NPM package injected with key-stealing malware. Versions 4.2.4–2.14.2 hit. Compromised via dev NPM access token Caught early by Aikido Security Sign & verify your releases, folks! 🛡️ #InfoSec #SupplyChainAttack #xrpl
7:48

👾#XRP hack breakdown xrpl NPM package injected with key-stealing malware. Versions 4.2.4–2.14.2 hit. Compromised via dev NPM access token Caught early by Aikido Security Sign & verify your releases, folks! 🛡️ #InfoSec #SupplyChainAttack #xrpl

Mackenzie Jackson -

13,606 views • 1 year ago

Introducing ▲ Streamdown A drop-in replacement for react-markdown, designed for AI-powered streaming. npm i streamdown (or just use AI Elements!) Link 👇
2:20

Introducing ▲ Streamdown A drop-in replacement for react-markdown, designed for AI-powered streaming. npm i streamdown (or just use AI Elements!) Link 👇

Hayden

101,635 views • 1 year ago

Vibe-coded prototypes get thrown away because they don’t use your design system code. Bolt’s Design System Agents fix this: - Upload your npm package, Storybook, repo, etc - Bolt builds using your design system - Engineering wires up the backend and ships
3:10

Vibe-coded prototypes get thrown away because they don’t use your design system code. Bolt’s Design System Agents fix this: - Upload your npm package, Storybook, repo, etc - Bolt builds using your design system - Engineering wires up the backend and ships

bolt.new

14,211 views • 5 months ago

The below video is real. No cuts. Founders + CTOs use this, and comapre it to Cursor + Claude Artifacts but prefer it because: - you can edit the code in your favorite IDE (two-way github sync) - automatically knows what npm package to use - picks up errors and fixes them - fast (built with rust)
1:47

The below video is real. No cuts. Founders + CTOs use this, and comapre it to Cursor + Claude Artifacts but prefer it because: - you can edit the code in your favorite IDE (two-way github sync) - automatically knows what npm package to use - picks up errors and fixes them - fast (built with rust)

Anton Osika

453,394 views • 2 years ago

You can quickly try different package managers in your repo with one simple script: `npx @turbo/workspaces convert` ◆ Handles lockfiles, node_modules, and workspace descriptors ◆ npm, yarn, and pnpm support ◆ Works for single and multi-package workspaces
1:30

You can quickly try different package managers in your repo with one simple script: `npx @turbo/workspaces convert` ◆ Handles lockfiles, node_modules, and workspace descriptors ◆ npm, yarn, and pnpm support ◆ Works for single and multi-package workspaces

Anthony Shew

27,952 views • 2 years ago

Vite+ shipped under MIT! 🎉 And the unified frontend toolchain now also has Bun support as package manager, in addition to existing pnpm, Yarn, and npm support.
0:57

Vite+ shipped under MIT! 🎉 And the unified frontend toolchain now also has Bun support as package manager, in addition to existing pnpm, Yarn, and npm support.

VoidZero

13,472 views • 4 months ago

Saw Aaryan gooey toast concept (via Ali Bey) and thought "I need this now!" 😩 So I vibed code it overnight and shipped it as an npm package goey-toast — morphing toast notifications for React - Organic pill → blob → pill animations - Promise toasts with loading → success/error - Action buttons, custom styling, full API - Built on Sonner + Framer Motion npm install goey-toast Demo & docs: GitHub:
0:27

Saw Aaryan gooey toast concept (via Ali Bey) and thought "I need this now!" 😩 So I vibed code it overnight and shipped it as an npm package goey-toast — morphing toast notifications for React - Organic pill → blob → pill animations - Promise toasts with loading → success/error - Action buttons, custom styling, full API - Built on Sonner + Framer Motion npm install goey-toast Demo & docs: GitHub:

Alfredo Natal

49,841 views • 6 months ago

25 loading buttons, open-source animated motion collection 13 webgl, svg/canvas/css, responsive, replayable, zero dependencies comment "LOADER" and i'll send you the npm + react native package
0:34

25 loading buttons, open-source animated motion collection 13 webgl, svg/canvas/css, responsive, replayable, zero dependencies comment "LOADER" and i'll send you the npm + react native package

jaimin

62,037 views • 29 days ago

Successefull use of film and package tape.
1:30

Sensitive content

Successefull use of film and package tape.

LustTek

185,304 views • 3 months ago

SOMEONE MADE IT SO YOU CAN CODE WITH 174 AI MODELS FROM 23 PROVIDERS FOR FREE one npm package and one install: "npm i -g free-coding-models" switch between any model instantly. benchmark them against each other in real time to see which one actually codes best for your use case. no subscriptions. no API keys. no cost. 174 models. 23 providers, all free, all from your terminal. if you're tired of paying for 3 different AI subscriptions just to compare which model codes better, this is it
2:55

SOMEONE MADE IT SO YOU CAN CODE WITH 174 AI MODELS FROM 23 PROVIDERS FOR FREE one npm package and one install: "npm i -g free-coding-models" switch between any model instantly. benchmark them against each other in real time to see which one actually codes best for your use case. no subscriptions. no API keys. no cost. 174 models. 23 providers, all free, all from your terminal. if you're tired of paying for 3 different AI subscriptions just to compare which model codes better, this is it

Om Patel

93,284 views • 5 months ago