Secure-Supply-Chain
handlebars-helpers
| Secure-Supply-Chain | handlebars-helpers | |
|---|---|---|
| 2 | 6 | |
| 27 | 2,193 | |
| - | 0.4% | |
| 1.8 | 0.0 | |
| over 2 years ago | 3 months ago | |
| JavaScript | ||
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Secure-Supply-Chain
- Microsoft Secure-Supply-Chain – Improving OSS Provenance
-
NPM package ‘ua-parser-JS’ with more than 7M weekly download is compromised
Semi-related: Microsoft is going to be (or has begun) checking for differences between published npm packages and their source control.
I got a PR in my repository a few days ago leading back to a team trying to make it easier for packages to be reproducible from source https://github.com/microsoft/Secure-Supply-Chain
handlebars-helpers
-
@lrvick bought the expired domain name for the 'foreach' NPM package maintainer. He now controls the package which 2.2m packages depend on.
https://www.npmjs.com/package/handlebars-helpers, if anyone is curious.
- Node.js packages don't deserve your trust
- NPM package ‘ua-parser-JS’ with more than 7M weekly download is compromised
- BREAKING!! NPM package ‘ua-parser-js’ with more than 7M weekly download is compromised
-
wait what!?
The biggest project that still depends on it is handlebars-helpers, which accounts for about half of the daily downloads. The other half are probably from installs of old versions of other libraries.
-
SBCL: New in Version 2.1.0
I am actually using handlebars along with helpers https://github.com/helpers/handlebars-helpers to automatically generate sql, golang, json and jsx. cl-who is only for markup.
What are some alternatives?
goggles.mozilla.org - Update: This project is no longer maintained and has been archived. See https://foundation.mozilla.org/blog/putting-away-our-x-ray-goggles/ for more information.
deno-puppeteer - A port of puppeteer running on Deno
ua-parser-js - UAParser.js - Free & open-source JavaScript library to detect user's Browser, Engine, OS, CPU, and Device type/model. Runs either in browser (client-side) or node.js (server-side).
koa-hbs - Handlebars templates for Koa.js
regex - An implementation of regular expressions for Rust. This implementation uses finite automata and guarantees linear time matching on all inputs.
deno - A modern runtime for JavaScript and TypeScript.
NUnit - NUnit Framework
lodash - A modern JavaScript utility library delivering modularity, performance, & extras.
Serilog - Simple .NET logging with fully-structured events
MediatR - Simple, unambitious mediator implementation in .NET
pnpm - Fast, disk space efficient package manager
LavaMoat - tools for sandboxing your dependency graph