Jordan Harband

the bottom row of a child’s teeth, but the front two teeth have two teeth behind them

🦈 my 6 year old’s “shark teeth”

I’m sure someone does; i don’t

“Are you any good at troubleshooting CSS?” with misaligned answer options

postit found at our team offsite

Big news: HeroDevs just raised $125M from PSG + Album 🎉
We’re doubling down on Never-Ending Support for EOL OSS.

✅ Securing deprecated frameworks
✅ $20M OSS Sustainability Fund now open

Let’s secure the future of open source.

#OSS #DevSecOps #CyberSecurity #EOL #HeroDevs

I’m confused, i still have DMs and don’t see anywhere to age-verify

*recalls* ok yeah this is funny

can you provide some context? i have no idea what Clinton signifies here

not me, a co-maintainer in a package.

the malware never existed in the repo, and no longer exists on npm.

npm ‘is’ Package Hijacked in Expanding Supply Chain Attack -... The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.

🚨 Attackers have hijacked the npm 'is' package (~2.8M weekly downloads), adding a malicious JS loader. This compromise is linked to the recent npm phishing campaign. Read our update on this ongoing supply chain attack: socket.dev/blog/npm-is-... #NodeJS #JavaScript

to complement my hither-thither staff, a hen-then staff?

Introducing OSS Rebuild: Open Source, Rebuilt to Last Posted by Matthew Suozzo, Google Open Source Security Team (GOSST) Today we're excited to announce OSS Rebuild, a new project to strengthen ...

oh hey look, it’s the actual solution for the thing that provenance will always fail to achieve that I’ve been telling folks to do for years and getting scoffed at security.googleblog.com/2025/07/intr...

The two bad versions have now been taken down entirely by @npmjs.bsky.social, thankfully.

I want to reiterate my deeply held belief. One of the biggest mistakes we are making with this tech is anthropomorphizing it and treating it like it is actually "reasoning". It's not doing that. And it cannot be held accountable. It's a machine.

ask a silly question ¯\_(ツ)_/¯

Mostly because it’s been around while - the modern approach is to use a single-purpose package instead of a grab bag. Just like lodash.

npm does require that now, and the package itself can’t be published without 2FA. an email takeover tho is sort of always the master key

true. but my assumption is that the hijacking caused it to get removed, but i wasn’t notified, so when he asked to be re-added it seemed normal.

lol k so basically all of them, got it

What they claimed was that their account did not have 2FA set up, and that’s why it was removed. Which seemed plausible, but made me irritated at npm. I am pretty confident that a username, once deleted, is burned forever.

also, v5.0.0, which got the same treatment. I assume this was from a pre-existing session and one of npm’s publish servers hadn’t caught up yet - tokens are disallowed (on virtually all my packages)

huh? No. I mean the account was removed from the package, not removed from npm

multiple people noticed and notified me through various channels. I was volunteering at my kid’s swim meet, so I didn’t get the messages until it was over.

Unfortunately, this took 6! hours before it was noticed. It would’ve been 1-2, but I was volunteering at my kids’ swim meet.

It’s entirely possible. The old owner was somehow removed from the npm package, and emailed me to be re-added. Everything seemed normal, so I obliged (irritated the npm would remove an owner without notifying the other owners) and the next morning this was published.

show me something that isn’t shit in this way, lol. get better takes.

is the definitive JavaScript type testing library. Latest version: 3.3.1, last published: 6 hours ago. Start using is in your project by running `npm i is`. There are 638 other projects in the npm regist...

Heads up that v3.3.1 of npmjs.com/is has malware in it, due to another maintainer’s account being hijacked. They’re removed for now, v3.3.0 is set at latest, v3.3.1 is deprecated, and a v3.3.2 will be published once I’m not on my phone (thx @github.com codespaces)

form-data A library to create readable

Harborist has published a new CVE:

www.cve.org/cverecord?id...

This is on all versions of the npmjs.com/form-data package, on all node versions. Please note: node 18+ and all modern browsers (caniuse.com?search=formd...) have FormData built in - please consider migrating to it!

new Date("wtf") How well do you know JavaScript's Date class?

I made a quiz about the JS Date parser is. It's very easy and you will score very high.

jsdate.wtf

congrats!

sounds, taps, and/or pictures?