POKÉMANIAC SIPH wants to fight! @Siphonay

1 post1 participant0 posts today

**Avoid the Hack!** @avoidthehack@infosec.exchange · 2d

Avoid the Hack! @avoidthehack@infosec.exchange

Week 11 of the #Privacy Roundup is out. Featuring:

- Data broker bragging about having personal information of billions of people
- How the ESP32 #Bluetooth backdoor isn't a backdoor
- North Korean government APTs spreading #malware on #Google play, #npm
- An ICE OSINT Tool that can monitor 200+ websites of a target
- #Apple patching an exploited zero-day in WebKit
- #Microsoft Patch Tuesday, 6 exploited zero-days

... and more, of course.

#privacymatters #cybersecurity #cve

https://avoidthehack.com/privacy-week11-2025

Avoid the Hack (avoidthehack!)Privacy Roundup: Week 11 of Year 2025Week 11 of the Privacy Roundup. Features data brokers bragging about collecting personal information, Apple patching an exploited zero-day in WebKit, AI and price discrimination, and an ICE OSINT tool that can monitor 200+ websites.

**The New Oil** @thenewoil@mastodon.thenewoil.org · 2025-03-11T20:42:19.000Z

The New Oil @thenewoil@mastodon.thenewoil.org

North Korean #Lazarus hackers infect hundreds via #npm packages

https://www.bleepingcomputer.com/news/security/north-korean-lazarus-hackers-infect-hundreds-via-npm-packages/

BleepingComputer · Mar 11North Korean Lazarus hackers infect hundreds via npm packagesBy Bill Toulas

#NorthKorea #cybersecurity #malware

Mar 12

**FlohEinstein** @FlohEinstein@chaos.social · Mar 6

FlohEinstein @FlohEinstein@chaos.social

Do you want to advertise "my Node.js product now uses AI!!" but don't know how to add AI?
Use the package "is-even-ai"

https://www.npmjs.com/package/is-even-ai

screenshot npm packge archive
is-even-ai
Check if a number is even using the power of ✨AI✨.
Uses OpenAI's GPT-3.5-turbo model under the hood to determine if a number is even.
For all those who want to use AI in their product but don't know how.

#nodejs #npm #isevenai

Mar 6

**Inautilo** @inautilo@mastodon.social · Feb 15

Inautilo @inautilo@mastodon.social

#Development #Launches
SQL Noir · A game to learn SQL by solving crimes https://ilo.im/162ciw

_____
#OpenSource #Game #Database #SQL #MySQL #SQLite #PostgreSQL #Npm #WebDev #Backend

Feb 15

**Deno** @deno_land@fosstodon.org · Feb 13

Deno @deno_land@fosstodon.org

Are you still using npm transpile services like esm.sh and unpkg.com?
dependency deduplication
install hooks and native add-ons
loading data files

Here's why we recommend importing npm packages natively via npm specifiers

https://deno.com/blog/not-using-npm-specifiers-doing-it-wrong

#deno #nodejs #npm

Feb 13

**Aral Balkan** @aral@mastodon.ar.al · Feb 4

Aral Balkan @aral@mastodon.ar.al

Just released Node Pebble version 5.1.1

• Updated to Pebble version 2.7.0.

• Now also supports macOS and arm64 (because Pebble itself does).

https://codeberg.org/small-tech/node-pebble

Node Pebble is a Node.js wrapper for Let’s Encrypt’s¹ Pebble² that:

• Downloads the correct Pebble binary for your platform.

• Launches and manages a single Pebble process.

• Returns a reference to the same process on future calls (safe to include in multiple unit tests where order of tests is undetermined)

• Automatically patches Node.js’s TLS module to accept Pebble server’s test certificate as well as its dynamically-generated root and intermediary CA certificates.

¹ https://letsencrypt.org

² “A miniature version of Boulder, Pebble is a small RFC 8555 ACME test server not suited for a production certificate authority.” https://github.com/letsencrypt/pebble

Summary card of repository small-tech/node-pebble

Codeberg.orgnode-pebbleA Node.js wrapper for Let’s Encrypt’s Pebble (a small RFC 8555 ACME test server not suited for a production certificate authority)

#LetsEncrypt #TLS #SSL

Feb 4

**Sebastian** @sebagutiem@chilemasto.casa · 2025-01-20T19:10:02.000Z

Sebastian @sebagutiem@chilemasto.casa

#Hackers despliegan paquetes #npm maliciosos para robar claves de billeteras #Solana por medio de #Gmail #SMTP
https://blogs.masterhacks.net/noticias/criptomonedas/hackers-despliegan-paquetes-npm-maliciosos-para-robar-claves-de-billetera-solana-a-traves-de-gmail-smtp/

Masterhacks Blog · Jan 20Hackers despliegan paquetes npm maliciosos para robar claves de billetera Solana a través de Gmail SMTP - Masterhacks BlogHackers despliegan paquetes npm maliciosos para robar claves de billeteras Solana por medio de Gmail SMTP

Jan 20

**The New Oil** @thenewoil@mastodon.thenewoil.org · 2025-01-08T05:11:54.000Z

The New Oil @thenewoil@mastodon.thenewoil.org

#Snyk security researcher deploys malicious #NPM packages targeting Cursor(dot)com

https://sourcecodered.com/snyk-malicious-npm-package/

SourceCodeRed · Jan 8Snyk security researcher deploys malicious NPM packages targeting Cursor.comA security researcher at Snyk published 5 malicious software packages to the NPM registry. These packages appear to target Cursor.com

#cybersecurity #AI

Jan 15

**The New Oil** @thenewoil@mastodon.thenewoil.org · 2025-01-03T15:53:34.000Z

The New Oil @thenewoil@mastodon.thenewoil.org

Malicious #npm packages target #Ethereum developers' private keys

https://www.bleepingcomputer.com/news/security/malicious-npm-packages-target-ethereum-developers-private-keys/

BleepingComputer · Jan 3Malicious npm packages target Ethereum developers' private keysBy Bill Toulas

#crypto #cybersecurity

Jan 6

**The New Oil** @thenewoil@mastodon.thenewoil.org · 2024-12-20T17:47:54.000Z

The New Oil @thenewoil@mastodon.thenewoil.org

Malicious #Rspack, #Vant packages published using stolen #NPM tokens

https://www.bleepingcomputer.com/news/security/malicious-rspack-vant-packages-published-using-stolen-npm-tokens/

BleepingComputer · Dec 20, 2024Malicious Rspack, Vant packages published using stolen NPM tokensBy Bill Toulas

#cybersecurity #malware

Dec 22, 2024

**Socket** @SocketSecurity@fosstodon.org · Dec 19, 2024

Socket @SocketSecurity@fosstodon.org

Rspack has been hit with a supply chain attack that injected cryptojacking malware into two @rspack_dev [bird.makeup] #npm packages. Versions 1.1.7 of both the core and CLI packages are affected.

https://socket.dev/blog/rspack-supply-chain-attack #JavaScript

Dec 19, 2024

**Audric** @audricd@tkz.one · Dec 18, 2024

Audric @audricd@tkz.one

#ayuda fediverso
estoy tratando de instalar #nextcloud (en hetzner) detras de un #nginx proxy manager #npm

en "local" me va (accediendo con el nombre de maquina que tengo en #tailscale (vease primer pantallazo)

este es el #docker compose que he usado:
https://github.com/nickistre/nextcloud-s3-docker
(estoy tratando de utilizar #s3 (backblaze)

luego, para meterlo en nginx estoy basandome en esta documentacion:
https://github.com/nextcloud/all-in-one/blob/main/reverse-proxy.md#nginx-proxy-manager---npm

tambien he añadido los "allowed hosts" con: el nombre de la maquina (hostname), la ip publica de hetzner, y la ip de tailscale (vease segundo pantallazo) basandome en esta documentacion:
https://docs.nextcloud.com/server/18/admin_manual/installation/installation_wizard.html#trusted-domains

pero aun con esas modificaciones:
- no puedo acceder al servicio salvo que no sea con local hostname. no me va ni con ip de tailscale, ni ip publica:puerto de hetzner
- en nginx npm, por una parte no puedo solicitar certificado. de nuevo: he probado con local hostname, localhost, ip tailscale, ip publica
- certificado aparte, la redireccion en si tampoco va. he probado con todos los nombres / ips que dije antes. me salta directamente (tiempo de carga instantaneo) a no encontrado (vease tercer pantallazo)

resumiendo: como se instala nextcloud con s3 storage y nginx npm?

se agradece #boost

Dec 18, 2024

**Deno** @deno_land@fosstodon.org · Nov 21, 2024

Deno @deno_land@fosstodon.org

Deno 2.1 is out ️
️ first class Wasm support
️ Long Term Support branch
️ Improved dependency management
and much more!

https://deno.com/blog/v2.1

Deno BlogDeno 2.1: Wasm Imports and other enhancementsDeno 2.1 introduces first-class Wasm imports, built-in tracing with OpenTelemetry, faster `deno compile`, and improved package management.

#deno #node #javascript

Nov 21, 2024

**Socket** @SocketSecurity@fosstodon.org · Nov 19, 2024

Socket @SocketSecurity@fosstodon.org

A threat actor published a playbook for exploiting #npm on a dark web forum, demonstrating how packages can be weaponized to build a blockchain-powered botnet. This rare inside look reveals the tools and techniques used in the latest supply chain attack.

https://socket.dev/blog/exploiting-npm-to-build-a-blockchain-powered-botnet #JavaScript

SocketThreat Actor Exposes Playbook for Exploiting npm to Build Bl...A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.

Nov 19, 2024

**Deno** @deno_land@fosstodon.org · Nov 8, 2024

Deno @deno_land@fosstodon.org

Deno is a JavaScript package manager with more flexibility:
️ npm and JSR
️ package.json and deno.json
️ fast

https://deno.com/blog/your-new-js-package-manager

Deno BlogIntroducing your new JavaScript package manager: DenoDeno’s new package manager, added in v2.0, is fast, flexible, and supports Node and package.json. Here’s how it works.

#deno #node #javascript

Nov 8, 2024

**paттуlцzїиa¯\_(ツ)_/¯** @pattyluzina@mastodon.social · Sep 22, 2024

paттуlцzїиa¯\_(ツ)_/¯ @pattyluzina@mastodon.social

Heute in der schönen #RegenbogenFabrik beim #npm zum Thema #opensource und #Fediverse vs. #BigTech. Und die Sonne scheint heute in #Berlin für beide Themen.