正在加载视频...

视频加载失败

加载此视频时出现问题。这可能是由于临时网络问题，或视频可能不可用。

“Just use an npm package” Socket

Feross

41,212 subscribers

30,679 次观看 • 3 个月前 •via X (Twitter)

Anya Rossi• Live Now

Private livecam show

2 条评论

小零的头像

小零3 个月前

@SocketSecurity 喜欢的话,我主页还有更多这种内容

Feross 的头像

Feross3 个月前

Source:

相关视频

1/4: 🚀 Big news from Socket! We're launching a new browser extension for Chrome, Firefox, Edge, & Brave. It helps you verify the security & trustworthiness of NPM packages before you install them. ✨ 👀 Let's see how it can help you avoid terrible NPM dependencies! 🗑️

1/4: 🚀 Big news from Socket! We're launching a new browser extension for Chrome, Firefox, Edge, & Brave. It helps you verify the security & trustworthiness of NPM packages before you install them. ✨ 👀 Let's see how it can help you avoid terrible NPM dependencies! 🗑️

Feross

14,377 次观看 • 3 年前

💥 Your AI coding assistant might be stealing your SSH keys. 💥 Socket found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.

💥 Your AI coding assistant might be stealing your SSH keys. 💥 Socket found an active Shai-Hulud style npm worm (SANDWORM_MODE) that hijacks CI workflows, spreads via stolen tokens, and injects rogue MCP servers to poison AI coding tools and steal secrets.

Feross

15,164 次观看 • 8 个月前

The `xz` package backdoor is just the tip of the iceberg. There's a CONSTANT low-level stream of malware and spyware being uploaded to npm, PyPI, and Go registries. I want to share a few examples from the 20,000+ malicious packages we detected so far:

The `xz` package backdoor is just the tip of the iceberg. There's a CONSTANT low-level stream of malware and spyware being uploaded to npm, PyPI, and Go registries. I want to share a few examples from the 20,000+ malicious packages we detected so far:

Feross

303,064 次观看 • 2 年前

I'm an engineer. I used to think sales was dirty. Cold calls, pushy tactics, all of it. The product should speak for itself. Running Socket changed my mind. I actually like sales now. Done well, sales is consultative. You help people understand a problem that matters, you're honest about where your product is strong and where it isn't, and you optimize for fit. That's not in tension with the engineering mindset. It's an extension of it. There are two ways to die as a company. Build a technically excellent product that nobody cares about. Or put sales in charge, underinvest in engineering, grow fast, and hit a ceiling when customers realize the product hasn't improved in five years. We've watched competitors do the second. The job is to keep engineering and sales both strong, and never let one dominate the other. I joined Anne Dwane on the Village Global podcast to talk about this, plus where Socket is today and why open source supply chain risk keeps getting worse. Full episode in the comments.

I'm an engineer. I used to think sales was dirty. Cold calls, pushy tactics, all of it. The product should speak for itself. Running Socket changed my mind. I actually like sales now. Done well, sales is consultative. You help people understand a problem that matters, you're honest about where your product is strong and where it isn't, and you optimize for fit. That's not in tension with the engineering mindset. It's an extension of it. There are two ways to die as a company. Build a technically excellent product that nobody cares about. Or put sales in charge, underinvest in engineering, grow fast, and hit a ceiling when customers realize the product hasn't improved in five years. We've watched competitors do the second. The job is to keep engineering and sales both strong, and never let one dominate the other. I joined Anne Dwane on the Village Global podcast to talk about this, plus where Socket is today and why open source supply chain risk keeps getting worse. Full episode in the comments.

Feross

13,243 次观看 • 3 个月前

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"

Introducing the new dev-browser cli. The fastest way for an agent to use a browser is to let it write code. Just `npm i -g dev-browser` and tell your agent to "use dev-browser"

Sawyer Hood

871,559 次观看 • 7 个月前

Claude Code: "npm add ..." You: "Use pnpm, you idiot!" *adds it to CLAUDE.md* Claude: "npm add ..." There's a better way:

Claude Code: "npm add ..." You: "Use pnpm, you idiot!" adds it to CLAUDE.md Claude: "npm add ..." There's a better way:

Matt Pocock

150,494 次观看 • 8 个月前

👾#XRP hack breakdown xrpl NPM package injected with key-stealing malware. Versions 4.2.4–2.14.2 hit. Compromised via dev NPM access token Caught early by Aikido Sign & verify your releases, folks! 🛡️ #InfoSec #SupplyChainAttack #xrpl

👾#XRP hack breakdown xrpl NPM package injected with key-stealing malware. Versions 4.2.4–2.14.2 hit. Compromised via dev NPM access token Caught early by Aikido Sign & verify your releases, folks! 🛡️ #InfoSec #SupplyChainAttack #xrpl

Mackenzie Jackson -

13,877 次观看 • 1 年前

Here's the first 3 minutes of how I'd publish a package to npm in 2024. Full video coming this week.

Here's the first 3 minutes of how I'd publish a package to npm in 2024. Full video coming this week.

Matt Pocock

42,692 次观看 • 2 年前

Introducing ▲ Streamdown A drop-in replacement for react-markdown, designed for AI-powered streaming. npm i streamdown (or just use AI Elements!) Link 👇

Introducing ▲ Streamdown A drop-in replacement for react-markdown, designed for AI-powered streaming. npm i streamdown (or just use AI Elements!) Link 👇

Hayden

101,710 次观看 • 1 年前

Vibe-coded prototypes get thrown away because they don’t use your design system code. Bolt’s Design System Agents fix this: - Upload your npm package, Storybook, repo, etc - Bolt builds using your design system - Engineering wires up the backend and ships

Vibe-coded prototypes get thrown away because they don’t use your design system code. Bolt’s Design System Agents fix this: - Upload your npm package, Storybook, repo, etc - Bolt builds using your design system - Engineering wires up the backend and ships

bolt.new

14,468 次观看 • 7 个月前

You can quickly try different package managers in your repo with one simple script: `npx @turbo/workspaces convert` ◆ Handles lockfiles, node_modules, and workspace descriptors ◆ npm, yarn, and pnpm support ◆ Works for single and multi-package workspaces

You can quickly try different package managers in your repo with one simple script: `npx @turbo/workspaces convert` ◆ Handles lockfiles, node_modules, and workspace descriptors ◆ npm, yarn, and pnpm support ◆ Works for single and multi-package workspaces

Anthony Shew

27,952 次观看 • 2 年前

The below video is real. No cuts. Founders + CTOs use this, and comapre it to Cursor + Claude Artifacts but prefer it because: - you can edit the code in your favorite IDE (two-way github sync) - automatically knows what npm package to use - picks up errors and fixes them - fast (built with rust)

The below video is real. No cuts. Founders + CTOs use this, and comapre it to Cursor + Claude Artifacts but prefer it because: - you can edit the code in your favorite IDE (two-way github sync) - automatically knows what npm package to use - picks up errors and fixes them - fast (built with rust)

Anton Osika

453,622 次观看 • 2 年前

Saw Aaryan gooey toast concept (via Ali Bey) and thought "I need this now!" 😩 So I vibed code it overnight and shipped it as an npm package goey-toast — morphing toast notifications for React - Organic pill → blob → pill animations - Promise toasts with loading → success/error - Action buttons, custom styling, full API - Built on Sonner + Framer Motion npm install goey-toast Demo & docs: GitHub:

Saw Aaryan gooey toast concept (via Ali Bey) and thought "I need this now!" 😩 So I vibed code it overnight and shipped it as an npm package goey-toast — morphing toast notifications for React - Organic pill → blob → pill animations - Promise toasts with loading → success/error - Action buttons, custom styling, full API - Built on Sonner + Framer Motion npm install goey-toast Demo & docs: GitHub:

Alfredo Natal

49,954 次观看 • 8 个月前

Vite+ shipped under MIT! 🎉 And the unified frontend toolchain now also has Bun support as package manager, in addition to existing pnpm, Yarn, and npm support.

Vite+ shipped under MIT! 🎉 And the unified frontend toolchain now also has Bun support as package manager, in addition to existing pnpm, Yarn, and npm support.

VoidZero

13,472 次观看 • 6 个月前

25 loading buttons, open-source animated motion collection 13 webgl, svg/canvas/css, responsive, replayable, zero dependencies comment "LOADER" and i'll send you the npm + react native package

25 loading buttons, open-source animated motion collection 13 webgl, svg/canvas/css, responsive, replayable, zero dependencies comment "LOADER" and i'll send you the npm + react native package

jaimin

63,282 次观看 • 3 个月前

Successefull use of film and package tape.

Sensitive content

Successefull use of film and package tape.

LustTek

189,815 次观看 • 5 个月前

SOMEONE MADE IT SO YOU CAN CODE WITH 174 AI MODELS FROM 23 PROVIDERS FOR FREE one npm package and one install: "npm i -g free-coding-models" switch between any model instantly. benchmark them against each other in real time to see which one actually codes best for your use case. no subscriptions. no API keys. no cost. 174 models. 23 providers, all free, all from your terminal. if you're tired of paying for 3 different AI subscriptions just to compare which model codes better, this is it

SOMEONE MADE IT SO YOU CAN CODE WITH 174 AI MODELS FROM 23 PROVIDERS FOR FREE one npm package and one install: "npm i -g free-coding-models" switch between any model instantly. benchmark them against each other in real time to see which one actually codes best for your use case. no subscriptions. no API keys. no cost. 174 models. 23 providers, all free, all from your terminal. if you're tired of paying for 3 different AI subscriptions just to compare which model codes better, this is it

Om Patel

93,660 次观看 • 7 个月前