is-number
event-stream
Our great sponsors
| is-number | event-stream | |
|---|---|---|
| 5 | 5 | |
| 245 | 2,157 | |
| - | - | |
| 0.0 | 0.0 | |
| over 1 year ago | over 5 years ago | |
| JavaScript | JavaScript | |
| MIT License | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
is-number
-
The honest truth about this subreddit
is-number https://github.com/jonschlinkert/is-number *
-
NPM – is-even, 160k weekly downloads
Looks like the author of these packages agrees. While the is-even and is-odd packages are under the i-voted-for-trump user with the description "This is a joke", the is-number package [1] is still kept under the main profile of the author, the repository is still active on GitHub and there are active issues.
-
BREAKING!! NPM package ‘ua-parser-js’ with more than 7M weekly download is compromised
Not[1] one[2] package[3] has more than 15 lines of actual code inside.
-
NPM Audit: Broken by Design
> not what the code in this package does
Here's `is-number` (https://github.com/jonschlinkert/is-number/blob/master/index...):
module.exports = function(num) { -
every function gotta be a package
Which also depends upon is-number
event-stream
-
I gave commit rights to someone I didn't know
Another possible outcome of "I gave commit rights to someone I didn't know": https://github.com/dominictarr/event-stream/issues/116
- Looking for open source Python lite wallet or Payment Processor with unified API for BTC, LTC, ETH, XMR, maybe others
-
What NPM Should Do Today to Stop a New Colors Attack Tomorrow
Whole npm ecosystem is so fragile.
Remember event-stream[1]? Did we learned something from that? Yes, we might. So was it improved? Never. People are still installing 'new' colors package and wondering why its texts are broken.
What if he uploaded malicious code rather than just just gibberish?
- NPM Audit: Broken by Design
-
Researcher hacks over 35 tech firms by creating public NPM packages
foo-bar version 1.0 depends on bada-boom 1.0 which depends on bada-bing 1.0. Now you update to foo-bar 1.1 because of some critical update, which in itself now depends on bada-boom 2.0 and bada-bing 2.0. But unbeknownst to you and the author of foo-bar, the bada-boom and bada-bing project was taken over by another maintainer who made an update, but also added some trojan horse code to specifically attack certain users, which was obfuscated and remained undetected. Which has happened before - not just browser extensions are affected by malicious attackers taking over useful projects.
What are some alternatives?
audit-ci - Audit NPM, Yarn, and PNPM dependencies in continuous integration environments, preventing integration if vulnerabilities are found at or above a configurable threshold while ignoring allowlisted advisories
enquirer - Stylish, intuitive and user-friendly prompts, for Node.js. Used by eslint, webpack, yarn, pm2, pnpm, RedwoodJS, FactorJS, salesforce, Cypress, Google Lighthouse, Generate, tencent cloudbase, lint-staged, gluegun, hygen, hardhat, AWS Amplify, GitHub Actions Toolkit, @airbnb/nimbus, and many others! Please follow Enquirer's author: https://github.com/jonschlinkert
romanice-dart - A Dart library for converting to/from Roman numerals.
cli - the package manager for JavaScript
proposal-built-in-modules
npm-force-resolutions - Force npm to install a specific transitive dependency version
pkg-vuln-collab-space - Project for work on improved Package Vulnerability Management & Reporting
micromatch - Highly optimized wildcard and glob matching library. Faster, drop-in replacement to minimatch and multimatch. Used by square, webpack, babel core, yarn, jest, ract-native, taro, bulma, browser-sync, stylelint, nyc, ava, and many others! Follow micromatch's author: https://github.com/jonschlinkert
LADX-Disassembly - Disassembly of Legend of Zelda: Links Awakening DX
is-odd - I created this in 2014, the year I learned how to program. All of the downloads are from an old version of https://github.com/micromatch/micromatch. I've done a few other things since: https://github.com/jonschlinkert.
colors.js - get colors in your node.js console