BREAKING!! NPM package ‘ua-parser-js’ with more than 7M weekly download is compromised

1. enquirer

   1 20 7,797 2.7 JavaScript

   Stylish, intuitive and user-friendly prompts. Used by eslint, webpack, yarn, pm2, pnpm, RedwoodJS, FactorJS, salesforce, Cypress, Google Lighthouse, Generate, tencent cloudbase, lint-staged, gluegun, hygen, hardhat, AWS Amplify, GitHub Actions Toolkit, @airbnb/nimbus, and more! Please follow Enquirer's author: https://github.com/jonschlinkert

   

   Simultaneously the #1 trending developer on GitHub across all languages (out of ~17 million developers at the time) with multiple #1 trending projects: Remarkable (https://github.com/jonschlinkert/remarkable), a markdown parser and compiler (also across all languages, out of ~7 million projects), Enquirer (https://github.com/enquirer/enquirer), a stylish, user-friendly prompt system.

2. Civic Auth

   www.civic.com featured

   Auth in Less Than 5 Minutes. Civic Auth comes with multiple SSO options, optional embedded wallets, and user management — all implemented with just a few lines of code. Start building today.

   

3. ua-parser-js

   2 36 9,640 9.2 JavaScript

   "Unmask Your Traffic" - UAParser.js: The Essential Web Development Tool for User-Agent Detection

   

   I don't particularly want to write all of this every time I want to figure out what browser someone is running.

4. deno

   3 485 102,871 10.0 Rust

   A modern runtime for JavaScript and TypeScript.

   

   Per-module wermissions per module was been discussed here but it was closed. Seems the reason was that "If you're going to import some file/package you should be responsible for checking what permissions it requires.".

5. remarkable

   4 5 5,800 2.5 JavaScript

   Markdown parser, done right. Commonmark support, extensions, syntax plugins, high speed - all in one. Gulp and metalsmith plugins available. Used by Facebook, Docusaurus and many others! Use https://github.com/breakdance/breakdance for HTML-to-markdown conversion. Use https://github.com/jonschlinkert/markdown-toc to generate a table of contents.

   

   Simultaneously the #1 trending developer on GitHub across all languages (out of ~17 million developers at the time) with multiple #1 trending projects: Remarkable (https://github.com/jonschlinkert/remarkable), a markdown parser and compiler (also across all languages, out of ~7 million projects), Enquirer (https://github.com/enquirer/enquirer), a stylish, user-friendly prompt system.

6. deno-puppeteer

   5 5 458 0.0 TypeScript

   A port of puppeteer running on Deno

   

   Maybe people forget about this permission system because either are not experienced with Deno or because they just slap -A on eveything. Some packages such as deno-puppeteer even put it in all examples without even adding a note about its risks.

7. is-mobile

   6 1 245 4.1 JavaScript

   Check if mobile browser, based on useragent string.

   

   If your only goal is to be certain you're dealing with a mobile device, a specialized library like is-mobile is probably a better fit.

8. GHSA-pjwm-rvh2-c87w

   7 8 - -

   Github has published an advisory for the package https://github.com/advisories/GHSA-pjwm-rvh2-c87w

9. SurveyJS

   surveyjs.io featured

   JavaScript Form Builder with No-Code UI & Built-In JSON Schema Editor. Add the SurveyJS white-label form builder to your JavaScript app (React/Angular/Vue3). Build complex JSON forms without coding. Fully customizable, works with any backend, perfect for data-heavy apps. Learn more.

   

10. handlebars-helpers

    8 6 2,231 0.0 JavaScript

    188 handlebars helpers in ~20 categories. Can be used with Assemble, Ghost, YUI, express.js etc.

    

11. lodash

    9 212 60,428 2.5 JavaScript

    A modern JavaScript utility library delivering modularity, performance, & extras.

    

12. vouch

    10 10 17 0.0 Rust

    A multi-ecosystem package code review system. (by vouch-dev)

    

13. open-source-at-scale

    11 1 46 10.0 JavaScript

    Discontinued talk at budapest 2014

    Listed in "Open Source at Scale" as #8 out of the top fifteen contributors to open source in the world (https://github.com/substack/open-source-at-scale)

14. AutoMapper

    12 32 10,129 6.9 C#

    A convention-based object-object mapper in .NET.

    

    https://www.nuget.org/packages/Newtonsoft.Json/ https://www.nuget.org/packages/AutoMapper/ https://www.nuget.org/packages/Dapper/ https://www.nuget.org/packages/FluentValidation/ https://www.nuget.org/packages/FluentAssertions/ https://www.nuget.org/packages/NUnit/ https://www.nuget.org/packages/xunit/ https://www.nuget.org/packages/YamlDotNet/ https://www.nuget.org/packages/Moq/ That is simply not true. Mature c# projects purposely maintain no downstream dependencies and is they do, it's to a major reputable lib. See for yourself - these are staple third party packages commonly used. Anything dependency starting with System or NETStandard is Microsoft maintained.

15. Dapper

    13 11 13,651 5.1 C#

    Discontinued Dapper - a simple object mapper for .Net [Moved to: https://github.com/DapperLib/Dapper] (by StackExchange)

    

    https://www.nuget.org/packages/Newtonsoft.Json/ https://www.nuget.org/packages/AutoMapper/ https://www.nuget.org/packages/Dapper/ https://www.nuget.org/packages/FluentValidation/ https://www.nuget.org/packages/FluentAssertions/ https://www.nuget.org/packages/NUnit/ https://www.nuget.org/packages/xunit/ https://www.nuget.org/packages/YamlDotNet/ https://www.nuget.org/packages/Moq/ That is simply not true. Mature c# projects purposely maintain no downstream dependencies and is they do, it's to a major reputable lib. See for yourself - these are staple third party packages commonly used. Anything dependency starting with System or NETStandard is Microsoft maintained.

16. FluentValidation

    14 25 9,338 7.9 C#

    A popular .NET validation library for building strongly-typed validation rules.

    

    https://www.nuget.org/packages/Newtonsoft.Json/ https://www.nuget.org/packages/AutoMapper/ https://www.nuget.org/packages/Dapper/ https://www.nuget.org/packages/FluentValidation/ https://www.nuget.org/packages/FluentAssertions/ https://www.nuget.org/packages/NUnit/ https://www.nuget.org/packages/xunit/ https://www.nuget.org/packages/YamlDotNet/ https://www.nuget.org/packages/Moq/ That is simply not true. Mature c# projects purposely maintain no downstream dependencies and is they do, it's to a major reputable lib. See for yourself - these are staple third party packages commonly used. Anything dependency starting with System or NETStandard is Microsoft maintained.

17. Fluent Assertions

    15 15 3,809 9.6 C#

    A very extensive set of extension methods that allow you to more naturally specify the expected outcome of a TDD or BDD-style unit tests. Targets .NET Framework 4.7, as well as .NET Core 2.1, .NET Core 3.0, .NET 6, .NET Standard 2.0 and 2.1. Supports the unit test frameworks MSTest2, NUnit3, XUnit2, MSpec, and NSpec3.

    

    https://www.nuget.org/packages/Newtonsoft.Json/ https://www.nuget.org/packages/AutoMapper/ https://www.nuget.org/packages/Dapper/ https://www.nuget.org/packages/FluentValidation/ https://www.nuget.org/packages/FluentAssertions/ https://www.nuget.org/packages/NUnit/ https://www.nuget.org/packages/xunit/ https://www.nuget.org/packages/YamlDotNet/ https://www.nuget.org/packages/Moq/ That is simply not true. Mature c# projects purposely maintain no downstream dependencies and is they do, it's to a major reputable lib. See for yourself - these are staple third party packages commonly used. Anything dependency starting with System or NETStandard is Microsoft maintained.

18. NUnit

    16 31 2,574 9.0 C#

    NUnit Framework

    

    https://www.nuget.org/packages/Newtonsoft.Json/ https://www.nuget.org/packages/AutoMapper/ https://www.nuget.org/packages/Dapper/ https://www.nuget.org/packages/FluentValidation/ https://www.nuget.org/packages/FluentAssertions/ https://www.nuget.org/packages/NUnit/ https://www.nuget.org/packages/xunit/ https://www.nuget.org/packages/YamlDotNet/ https://www.nuget.org/packages/Moq/ That is simply not true. Mature c# projects purposely maintain no downstream dependencies and is they do, it's to a major reputable lib. See for yourself - these are staple third party packages commonly used. Anything dependency starting with System or NETStandard is Microsoft maintained.

19. xUnit

    17 44 4,355 9.6 C#

    xUnit.net is a free, open source, community-focused unit testing tool for .NET.

    

    https://www.nuget.org/packages/Newtonsoft.Json/ https://www.nuget.org/packages/AutoMapper/ https://www.nuget.org/packages/Dapper/ https://www.nuget.org/packages/FluentValidation/ https://www.nuget.org/packages/FluentAssertions/ https://www.nuget.org/packages/NUnit/ https://www.nuget.org/packages/xunit/ https://www.nuget.org/packages/YamlDotNet/ https://www.nuget.org/packages/Moq/ That is simply not true. Mature c# projects purposely maintain no downstream dependencies and is they do, it's to a major reputable lib. See for yourself - these are staple third party packages commonly used. Anything dependency starting with System or NETStandard is Microsoft maintained.

20. Serilog

    18 65 7,532 7.9 C#

    Simple .NET logging with fully-structured events

    

21. MediatR

    19 59 11,625 6.0 C#

    Simple, unambitious mediator implementation in .NET

    

22. is-odd

    20 19 155 0.0 JavaScript

    Discontinued I created this in 2014, the year I learned how to program. All of the downloads are from an old version of https://github.com/micromatch/micromatch. I've done a few other things since: https://github.com/jonschlinkert. (by i-voted-for-trump)

    

    Not[1] one[2] package[3] has more than 15 lines of actual code inside.

23. is-even

    21 27 96 0.0 JavaScript

    Discontinued I created this in 2014, when I was learning how to program. (by i-voted-for-trump)

    

    Not[1] one[2] package[3] has more than 15 lines of actual code inside.

24. is-number

    22 6 268 0.0 JavaScript

    JavaScript/Node.js utility. Returns `true` if the value is a number or string number. Useful for checking regex match results, user input, parsed strings, etc.

    

    Not[1] one[2] package[3] has more than 15 lines of actual code inside.

25. Babel (Formerly 6to5)

    23 62 43,575 9.8 TypeScript

    🐠 Babel is a compiler for writing next generation JavaScript.

    

    @cdb_11 found it depends on a npm package with one line of code. They finally removed it a couple years ago - https://github.com/babel/babel/issues/9620

26. micromatch

    24 7 2,908 6.3 JavaScript

    Highly optimized wildcard and glob matching library. Faster, drop-in replacement to minimatch and multimatch. Used by square, webpack, babel core, yarn, jest, ract-native, taro, bulma, browser-sync, stylelint, nyc, ava, and many others! Follow micromatch's author: https://github.com/jonschlinkert

    

    Since then they've made things that are IMO quite useful, like enquirer, micromatch, and remarkable.

27. npm-force-resolutions

    25 1 571 0.0 Clojure

    Force npm to install a specific transitive dependency version

    

    @GradeyCullins I believe the typical NPM-equivalent to resolve this sort of problem is to use this package: https://github.com/rogeriochaves/npm-force-resolutions

28. crater

    26 24 688 8.5 Rust

    Run experiments across parts of the Rust ecosystem! (by rust-lang)

    

    It does exist, but it only has 80 downloads over the last 90 days and 1,043 in the three years that it has existed. That's probably all because of crater.

29. InfluxDB

    www.influxdata.com featured

    InfluxDB – Built for High-Performance Time Series Workloads. InfluxDB 3 OSS is now GA. Transform, enrich, and act on time series data directly in the database. Automate critical tasks and eliminate the need to move data externally. Download now.

    

Suggest a related project