Kado JavaScript

An Open Source @NodeJS JavaScript Framework.

#KadoJS #NodeJS #javascript #code #opensource #webdeveloper

[Kado JavaScript @KadoJavaScript]

Kado is an open source Node.js framework! We have libraries that help with many coding tasks. Start building web applications for browser, mobile and desktop today!

#100DaysOfCode #javascript #php #python #30Daysofcode #javascript30 #reactjs #wordpress #jquery #angularjs #nodejs

[Kado JavaScript @KadoJavaScript]

PHP2Shell, then Brotli/Node2Shell. This week every dependency was a pager. If you run Node, you want 22.23.4, 24.22.1 or 26.12.1. Then check what else bundles Brotli. Boring, stable, few deps is the best security strategy there is. #JavaScript #nodejs #CyberSecurity

[Kado JavaScript @KadoJavaScript]

@jimrandomh The downstream-bundling point is the whole story. npm ls and your lockfile won't show a C library compiled into a native addon or a container base image. If you only bumped Node, check your Docker base images too.

[Kado JavaScript @KadoJavaScript]

@_absnt Pinning still matters; it just stopped being enough. Pin plus a lockfile you actually review plus fewer transitive deps. We've kept Kado at 4.4.0 since 2022 on purpose, because "nothing changed" is a feature when the rest of the stack is on fire.

[Kado JavaScript @KadoJavaScript]

@MagicalTux "broccoli2shell" deserves to win. Real lesson of the week though: every dependency is a pager you didn't know you signed up for. Fewer deps, older deps, boring deps.

[Kado JavaScript @KadoJavaScript]

@levelsio What makes Brotli worse than PHP is that it's vendored everywhere. Bumping Node to 22.23.4 / 24.22.1 / 26.12.1 covers Node, but your Python wheels, Envoy, and anything that statically linked it are each their own patch. Run an SBOM grep tonight.

[Kado JavaScript @KadoJavaScript]

@SandrineZambou The quiet lesson of this week: every service you lean on can have a bad week. Not saying go offline, but know the three things your deploy can't live without and have a plan B for each.

[Kado JavaScript @KadoJavaScript]

@NodeSource @_rafaelgss Huge thanks to everyone patching this week. Wish from the cheap seats: a one-command "which of this week's CVEs hit my install" check. After this month, most teams just want to know if they can sleep tonight.

[Kado JavaScript @KadoJavaScript]

@strapijs @nodejs Node 20 folks: EOL lines aren't getting this fix, so this is the nudge to move to 22 or 24. Until you can, find where your app decompresses untrusted data (request bodies, fetched responses) and turn Brotli off there.

[Kado JavaScript @KadoJavaScript]

@patricecassard One HTML file, zero dependencies is underrated. Nothing to audit, nothing to break in two years. We've run a zero-dep Node framework (Kado) on the same release since 2022, and the boring stability is the feature.

[Kado JavaScript @KadoJavaScript]

@Sad_HAMs_ Thanks to everyone pulling night shifts. For Node folks still catching up: the fixed releases are 22.23.4, 24.22.1 and 26.12.1, and the old version usually hides in Docker base images and CI runners, not your laptop.

[Kado JavaScript @KadoJavaScript]

@giffmana Agree on fewer libraries, but you may not need a new language. Node's stdlib covers a lot now (fetch, crypto, test runner, fs/promises). We maintain a zero-dependency Node framework (Kado) and it's very doable. The hard part is habits, not tooling.

[Kado JavaScript @KadoJavaScript]

Friday homework after Black October: run npm ls --all | wc -l on your main app.

Every line is someone who can ship code into your build. Pick 3 you could swap for stdlib (fetch, crypto.randomUUID, fs/promises) and drop them.

#nodejs #javascript #BlackOctober

[Kado JavaScript @KadoJavaScript]

@jetpackjoe_ Split the rule. Security releases for the runtime itself (Node, PHP) go in fast. New versions of random packages can wait a few days with a minimum release age. Poisoned releases often get caught and yanked in that window.

[Kado JavaScript @KadoJavaScript]

@rishabincloud The common thread is secrets living on platforms you don't control. Worth a weekend: list every key, scope each one down to what it actually needs, and set spend caps at the provider so a leak is a bad day, not a bad month.

[Kado JavaScript @KadoJavaScript]

@CharliLaFerrari Easy first pass: npm ls --all | wc -l, then hunt for packages wrapping a few lines of stdlib (fetch, crypto.randomUUID, fs/promises cover a lot now). Every dep you drop is one less stranger's password you trust. It's why we built Kado with zero.

[Kado JavaScript @KadoJavaScript]

@0x0SojalSec Adding one for the Node folks: Node.js fixed 10 CVEs this week (22.23.4 / 24.22.1 / 26.12.1). Check the Node inside your Docker base images and CI runners too, not just your laptop. That's where old versions hide.

[Kado JavaScript @KadoJavaScript]

@infinterenders The pattern in that list: most of the damage came from trust people inherited, not code they wrote. Pin exact versions, commit the lockfile, and ask now and then whether each dependency is earning its place.

[Kado JavaScript @KadoJavaScript]

@S1r1u5_ Fair, and worth separating. But once fixes ship, the diff is a roadmap, and PHP is already seeing mass scanning. Calm checklist beats panic: node -v in prod, rebuild images, restart, patch PHP.

[Kado JavaScript @KadoJavaScript]

Node.js fixed 10 CVEs yesterday (22.23.4 / 24.22.1 / 26.12.1).

Check node -v in prod, not on your laptop. Rebuild Docker base images. Restart long-running processes.

Upgrading is easier when there's no dependency tree to re-test.

#nodejs #javascript #BlackOctober

[Kado JavaScript @KadoJavaScript]

@SocketSecurity If 1.107.0 got installed anywhere, don't just downgrade. Treat that machine as burned: rotate cloud and AI provider keys, check SSH keys and CI secrets, rebuild the image. Good night to pin exact versions and stop auto-installing latest.