DevOps.js

DevOps.js Conf 2022

NPM workspaces help manage multiple nested packages within a single top-level package, improving since the release of NPM CLI 7.0. You can easily add dependencies to workspaces and handle duplications. Running scripts and orchestration in a monorepo is made easier with NPM workspaces. The npm pkg command is useful for setting and retrieving keys and values from package.json files. NPM workspaces offer benefits compared to Lerna and future plans include better workspace linking and adding missing features.

Learn more about how to leverage the default features of npm workspaces to help you manage your monorepo project while also checking out some of the new npm cli features. <a href="https://www.froala.com/wysiwyg-editor?pb=1"> </a>

Levelling up Monorepos with npm Workspaces

Ruy Adorno

JSNation US

JSNation US 2024

I'm Zebe, a JavaScript developer with a focus on security. Let's talk about the risks of consuming NPM packages, particularly malicious ones. We explore how to obtain and run malware, as well as evaluate and analyze JavaScript malware in Node.js. Malware can be delivered as pre-compiled bytecode, and defenses involve tools like npm audit. Hardin JavaScript and Lafamote are security tools that protect JavaScript applications and dependencies. Lafamote puts each package in its own compartment and provides tooling to create access policies. It prevents stolen cookies and restricts access to sensitive globals. Limited time offer to help set up projects with Lafamote.

Watch me run real obfuscated malware from NPM safely while revealing what it does.  Learn how it's possible and use the technology behind it to secure your application from malicious code that gets past your audits and detections. And if obfuscation is not enough, watch it applied to a malware payload delivered as pre-compiled V8 bytecode with no source code provided for it.

Watch Me Run Malware From NPM

Zbyszek Tenerowicz

DevOps.js Conf 2024

Today we'll discuss the evolution and implementation of YARN, which focuses on determinism and stability. YARN Modern was re-architected to support projects with multiple packages and embraced Monorepos. YARN 2 improved workspace implementation, codebase partitioning, and stability. Dependency resolution and linking in YARN are handled by different resolvers and fetchers. YARN has a plugin system, a constraint engine, and a redesigned website. It prioritizes compatibility, performance, testing, and contributions to other projects.

In this talk, we'll go over the various iterations the Yarn team went through designing one of the most critical software in the JavaScript ecosystem. We'll discuss some of the main choices, trade-offs, errors, and successes we faced, and think about evolutions to come and future challenges that await us. By the end of this talk you'll have a better understanding of the work large-scale open-source teams do behind the team, and hopefully a better understanding of what makes open-source so special.

Yarn: From Design to Implementation

Maël Nison

This Talk discusses pain points and effective package management in monorepos, including the use of hoisted or isolated layouts and the challenges of working with peer dependencies. It introduces the tool Bit, which addresses these issues and handles dependency management and version control. Bit enables automatic installation and management of dependencies, supports multiple versions of a peer dependency, and seamlessly updates components across different environments.

We’ll talk about some of the pain points and look into recipes for effective package management in monorepos.  We’ll discuss how package management works with npm, pnpm, and Yarn. Furthermore, I’ll show you a new tool that is less known but improves developer experience by a lot.

Package Management in Monorepos

Zoltan Kochan

TS Congress

TypeScript Congress 2023

Mark Erickson discusses the complexities of publishing TypeScript libraries, including considerations like build artifact file formats, package exports, and different user environments. He shares his experiences with ESM support and interop with other module formats, and the challenges faced in migrating Redux to TypeScript. Erickson highlights the importance of understanding file formats and module types, and the insights gained from discussions with the TypeScript team. He also emphasizes the need for better tools and documentation in the ecosystem for publishing and maintaining TypeScript libraries.

Publishing libraries to NPM is easy - just `tsc &amp;&amp; npm publish` and you're done, right? Whoops, you forgot proper ESM compat. And a user is asking for a UMD build. And it doesn't work in Webpack 4. And `moduleResolution: "node16"` can't find the types. Publishing libraries today is _complicated_. We'll take a look at the many problems and questions you should consider when publishing a package, and some hard-earned possible answers to those questions.type

Publishing TS Libraries for Fun and Profit

Mark Erikson

JS Nation

JSNation 2023

The Talk discusses speeding up MonrayBus in a pmpm workspace by organizing packages and considering dependencies. It covers installing and configuring the nx package, including choosing cacheable scripts. The nx-graph command is introduced for analyzing dependencies and optimizing the build process.

They gave me just 7 minutes! So this is a no-slides, just code talk! I'm gonna show you a Yarn/NPM/PNPM workspaces-based monorepo implementation and how we can speed it up. In particular, I'm using Nx on top to get better parallelization, the ability to define task pipelines, caching, and more. Curious? Join me!

Package-based Monorepos - Speed Up in Under 7 Minutes

Juri Strumpflohner

JSNation 2022

This Workshop on Open Source and Security covers topics such as the use of open source packages in JavaScript, the risks and vulnerabilities associated with open source, and real-world examples of vulnerabilities and exploits. It emphasizes the importance of promptly addressing vulnerabilities and provides insights into fixing vulnerabilities using tools like Snyk. The Workshop also discusses best practices for package maintenance, triaging vulnerabilities, and integrating security measures into software development pipelines.

npm and security, how much do you know about your dependencies?Hack-along, live hacking of a vulnerable Node app https://github.com/snyk-labs/nodejs-goof, Vulnerabilities from both Open source and written code. Encouraged to download the application and hack along with us.Fixing the issues and an introduction to Snyk with a demo.Open questions.

Finding, Hacking and fixing your NodeJS Vulnerabilities with Snyk

Matthew Salmon

React Summit

React Summit 2022

Today's Workshop focused on building Web3 apps with React using JavaScript, without the need for smart contract code. The Hyperverse was introduced as a community-built, open, and audited platform for modular smart contracts. The Workshop covered topics such as blockchain basics, digital signatures, wallets, fees, and token types. A demo of a Web3 application was showcased, along with the process of confirming transactions and starting a battle between tribes. The Workshop also discussed initializing Hyperverse and modules, connecting wallets, joining and leaving tribes, creating custom tribes, and implementing battle functionality and ERC-721 tokens.

The workshop is designed to help Web2 developers start building for Web3 using the Hyperverse. The Hyperverse is an open marketplace of community-built, audited, easy to discover smart modules. Our goal - to make it easy for React developers to build Web3 apps without writing a single line of smart contract code. Think “npm for smart contracts.” Learn more about the Hyperverse <a href="https://www.decentology.com/hyperverse">here</a>. We will go over all the blockchain/crypto basics you need to know to start building on the Hyperverse, so you do not need to have any previous knowledge about the Web3 space. You just need to have React experience.

Build Web3 apps with React 

Shain Dholakiya

This talk discusses the security challenges in the JavaScript ecosystem, including supply chain security, lock file tampering, and arbitrary command execution. It highlights the risks of blind upgrades and hidden comments in code. The talk also covers dependency confusion attacks and the importance of establishing a threat model for node applications.

The omnipresence of open-source software and low-barrier of entry on npmjs are serving as a catalyst for supply chain security incidents that are continuously impacting JavaScript developers. What can we do to protect ourselves?

Security Controls in the JavaScript Supply Chain

Liran Tal

Node Congress

Node Congress 2022

npm install can be a mysterious process, but understanding how package managers work is essential. NPM solved problems like large node_modules, circular dependencies, and multiple instances of the same package. Managing package versions and conflicts is crucial for consistency across projects. Alternative approaches to package management, like PNPM and Yarn2, provide insights into the hidden complexities of package managers.

Ever wondered what happens after you hit npm install and go to grab a coffee? Let's deep dive into Npm and Yarn installation process, and how you can put this knowledge into practice. <a href="https://www.froala.com/wysiwyg-editor?pb=1"> </a>

The Secret Life of Package Managers

Tally Barak

DevOps.js Conf 2021

Welcome to my talk on what's new in the NPM CLI. NPMv7 introduced many new capabilities, including installing peer dependencies by default. npm v7 also introduced support for workspaces, allowing the definition of projects within your root project. The NPM team is continuously improving the CLI with weekly releases and is working on exciting features in collaboration with GitHub. NPM is not an acronym for Node Package Manager, and the CLI will continue to improve with the support of the growing team.

The npm CLI has been, &amp; continues to be, a core developer tool of the Node.js/JavaScript ecosystem. This past year npm@7 became Generally Availble, introducing with it a wealth of changes &amp; net-new capabilities including: lockfile upgrades, workspace support, installing peer dependencies default, npm diff, npm explain, npm exec, npm set-script &amp; much, much more. We'll dive into this work as well as share some exciting news about what to expect in the weeks &amp; months to come. <a href="https://www.froala.com/wysiwyg-editor?pb=1"> </a>

#npm