npm
@npmjs
Followers
146K
Following
680
Media
1K
Statuses
5K
The package manager for JavaScript. Problems? Visit https://t.co/WNuo1MMbMP or https://t.co/i3MoAdr5p5.
Joined June 2011
track direct and transitive dependencies for npm packages with GitHub’s dependency graph ⬇️ https://t.co/qpGGToVKFb
github.blog
npm’s massive ecosystem of open source packages is one of its greatest strengths. But as a security-conscious developer, it can be tough to keep up with vulnerability reporting and updates…
4
9
44
starting today, developers building npm projects on @GitHub Actions can request a provenance statement to be published alongside their package, giving consumers a verifiable way to link a package back to its source repository and build instructions. https://t.co/8zilYJz5Dc
github.blog
How to verifiably link npm packages to their source repository and build instructions.
15
74
255
Now you can create tokens with fine-grained permissions for automating your publishing and org management workflows. And a new code explorer allows you to view content of a package directly in the npm portal.
github.blog
Now you can create tokens with fine-grained permissions for automating your publishing and organization management workflows. And a new code explorer allows you to view content of a package directly...
3
11
40
⚡️ #7: Use npm query and jq to dig into your dependencies https://t.co/PWfxmK21ja You can use the new "npm query" command and jq to answer interesting questions about your package's dependencies #terminalrocks
8
17
44
Today we opened an RFC with a proposal of how npm can collaborate with @projectsigstore to link packages to their source and build, a significant improvement to the supply chain security of the JavaScript ecosystem.
github.blog
Supply chain attacks exploit our implicit trust of open source to hurt developers and our customers. Read our proposal for how npm will significantly reduce supply chain attacks by signing packages...
6
40
145
🚀 we just shipped npm v8.16.0 with the new `npm query` command 📦 this new feature allows developers to quickly ask & answer questions about their project's dependencies. you can learn more here: https://t.co/ZnAqV4x2Am ⬇️ to get it now, run: $ npm install -g npm
github.blog
npm query is a new top-level command as of npm v8.16.0 which accepts a Dependency Selector (as defined in the Dependency Selector Syntax Specification) & returns a filtered JSON Array/NodeList…
3
30
79
We've launched a number of security enhancements to npm including: * Improved login and publish experience /w CLI * Connecting GitHub + Twitter accounts * All packages have been resigned and a new command `npm audit signatures` Read more at:
3
58
198
do you publish from a npm workspace & use a root-level ignore file? if so, you should update to npm v8.11.0 or the latest versions of Node.js 16/17/18 to avoid a recently discovered vulnerability that wouldn't respect these files. read the advisory here:
github.com
### Impact `npm pack` ignores root-level `.gitignore` & `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=`)...
4
24
44
GitHub has been actively investigating the attack campaign around stolen OAuth tokens, of which @npmjs was a victim organization. Today we’re sharing our final impact analysis for npm as well as additional findings.
github.blog
npm's impact analysis of the attack campaign using stolen OAuth tokens and additional findings.
GitHub has uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI. Read more about the impact to GitHub, npm, and our users.
2
98
193
🔒 an enhanced npm 2FA experience is now available in public beta. it includes: * support for physical security keys and biometric devices * support for multiple second factors * a new 2FA configuration menu and more! https://t.co/ZPtp0Gd2QU
github.blog
Late last year, in response to an unprecedented series of account takeovers resulting from the compromise of developer accounts without 2FA enabled, we committed to a variety of enhancements to…
1
37
63
🚀 Our CLI team just shipped their weekly release! 📦 npm@8.9.0 makes `npm owner` workspace-aware & also comes with some docs, deps & core updates/fixes. ⬇️ Get it now: $ npm install -g npm See more in the changelog: https://t.co/EuBNJ1VnYA
github.com
v8.9.0 (2022-05-04) Features 62af3a1 #4835 feat: make npm owner workspace aware (@wraithgar) Bug Fixes d654e7e #4781 fix: start consolidating color output (@wraithgar) b9a966c #4843 fix(exec): i...
0
8
25
A new @npmjs cli release is out! 🚀 📦 npm@8.8.0 adds a new `--install-links` option to opt into packing+install dependencies defined using the `file:` protocol instead of symlinking. ⬇️ Get it now: $ npm install -g npm See more in the changelog:
github.com
v8.8.0 (2022-04-27) Features bedd8a1 #4745 feat: add install-links config definition (@nlf) Bug Fixes 6253d19 #4643 fix(exec): workspaces support (@ruyadorno) e9163b4 #4657 fix(libnpmpublish): u...
1
8
22
we've got a jam packed Open RFC call today w/ some exciting topics like: v9 roadmap, `npm query` + dependency selector syntax, command-specific configuration & more... come join us live at 2pm EST: https://t.co/UFNKgH7qUt
#npm #nodejs #javascript
github.com
Why? In our ongoing efforts to better listen to & collaborate with the community, we've started an Open RFC call that helps to move conversations & initiatives forward. When? Wednesday,...
2
9
17
It's npm cli release day again! 🎉 🚀 npm@8.4.1 - fixes `npm ci` lock file validation - fixes parsing aliases in `npm outdated` - And more! ⬇️ Get it now: npm install -g npm See more in the changelog:
github.com
v8.4.1 (2022-02-03) Bug Fixes 1b9338554 #4359 fix(log): pass in logger to external modules (@wraithgar) 457e0ae61 #4363 fix(ci): lock file validation (@ruyadorno) c0519edc1 #4364 fix(ci): should n...
23
7
33
exciting open rfc meeting planned today at 11am pt / 2pm et; we've got a full agenda including new rfcs for package distributions & ux changes to clean up deprecation warnings: https://t.co/yTVIrB9wlo 🎙 come join the discussion or watch live on youtube https://t.co/tegjwHbRe9
youtube.com
npm inc. is a company founded in 2014, and was acquired by GitHub in 2020. npm continues to be the world's largest software registry. Open source developers from every continent use npm to share and...
12
4
11
today we enrolled all maintainers of the top-100 npm packages in mandatory 2FA. read more about it on our blog:
github.blog
Starting today, all maintainers of top-100 npm packages, by dependents, will now be enrolled in mandatory 2FA for their accounts.
8
34
199
a quick reminder that, on Tuesday, February 1, maintainers of the top-100 packages on the npm registry will be enrolled in mandatory 2FA
2
9
25
we hope to see you at our weekly open rfc meeting today! check out what's on the agenda and how to join ⬇️
github.com
Why? In our ongoing efforts to better listen to & collaborate with the community, we've started an Open RFC call that helps to move conversations & initiatives forward. When? Wednesday,...
2
2
6
we just shipped a number of security-focused improvements to npm including: - naming access tokens - enforcing 2FA in your npm orgs - improved auditing for 2FA adoption in orgs - selecting teams when adding new org members read more in our Changelog ⬇️
github.blog
As part of our ongoing commitment to npm ecosystem security, and in advance of enforcing two-factor authentication for top packages maintainers, the npm team has been hard at work improving…
2
24
53
open rfc meeting is on for today and we've got a full agenda! we'll see you at 11am pt / 2pm et 🕚
github.com
Why? In our ongoing efforts to better listen to & collaborate with the community, we've started an Open RFC call that helps to move conversations & initiatives forward. When? Wednesday,...
1
1
3