npm’s Biggest Supply Chain Attack (and What We Learned)

Key takeaways

Storybook 10's shift to ESM leads to significant performance improvements and new features.
The npm supply chain attack highlights the critical need for improved security practices within package management.
Brave's discovery of vulnerabilities in AI browsers showcases the risks inherent in rapidly evolving tech.
Personal tech experiences can enhance productivity and enjoyment in daily routines.

Summary

Storybook 10: ESM and Performance Gains

The episode kicks off with an exciting announcement about Storybook 10, which has entered its beta release. It focuses on the transition to ESM (ECMAScript Modules) only, eliminating CommonJS support. The hosts discuss how this change leads to significant performance gains, with the new version being 48% smaller than its predecessor, Storybook 9. Enhanced features such as accessibility tests, interaction tests, and story generation tools are emphasized, showcasing how Storybook is evolving into a comprehensive testing suite for developers.

npm's Massive Supply Chain Attack

In a concerning turn of events, npm faced a massive supply chain attack where a maintainer was tricked into clicking a phishing link. This allowed hackers to gain access to critical packages with hundreds of millions of downloads. The hosts reflect on the vulnerabilities within the npm ecosystem and the implications of such attacks. The discussion highlights the importance of robust security measures, including multi-factor authentication and thorough audits of package dependencies.

Brave's Vulnerability Findings in Comet

The episode shifts gears to discuss a security vulnerability uncovered by Brave in the Comet browser. This flaw allowed the AI browser to execute malicious commands embedded in ordinary web page text. The hosts stress the rising risks associated with AI browsers and the importance of enhancing security frameworks in this emerging technology. They note how easily the vulnerability was exploited, further underlining the growing need for cautious implementation of AI tools in everyday applications.

What's Making Us Happy

In a lighter segment, the hosts share personal highlights of their week, including new tech products and nostalgic shows. Jack talks about his satisfaction with bone-conducting headphones, emphasizing their convenience for calls and while exercising. Paige praises the satirical brilliance of the TV show "Silicon Valley," reflecting on its prescient humor about the tech industry. Lastly, TJ offers useful tips for syncing SMS messages to Macs, sharing a setting that enhances productivity for Apple users.

Show notes

Just 5 months ago we covered how Storybook 9 was in beta, and already Storybook 10 is in beta. The biggest change is that Storybook is going all in on ESM and dropping CJS support, which is making for some big performance gains and smaller bundle sizes.

This past week, npm suffered the largest supply chain attack in its history when a prolific OSS maintainer got phished. Luckily, the attack was noticed and reported within the hour and it looks like the hackers got next to nothing for their efforts, but it serves as another reminder to be extra careful before clicking links in emails.

In the same security vein, browser company Brave uncovered a security vulnerability in AI-browser Comet where malicious instructions on a web page could cause the agent to “go rogue” while it was being asked to summarize a page’s contents. Perplexity has since added more guardrails to try and mitigate this sort of thing, but be cognizant of the data and site access you’re giving to AI agents.

Timestamps:

1:12 - Storybook 10
7:53 - npm’s supply chain attack
17:24 - Brave discloses a security vulnerability in Comet
26:38 - You’re absolutely right!
35:26 - What’s making us happy

Links:

Thanks as always to our sponsor, the Blue Collar Coder channel on YouTube. You can join us in our Discord channel, explore our website and reach us via email, or talk to us on X, Bluesky, or YouTube.