用Baseline审计依赖，看清浏览器原生支持，砍掉多余JS库，让网页更轻更快
The gap between “you need a library for this” and “the browser does this” keeps closing. A practical guide to auditing your dependencies and finding w…
呼吁真正可拥有的操作系统，批判大公司控制与依赖臃肿，直击自主权痛点
In software we have put too much control in the hands of corporations and organization. It is time to start putting the control in the hands of the in…
在线对比JSON文件，让package-lock.json的增删改一目了然，支持语法高亮和差异化视图，快速发现依赖变化。
You open a pull request. It touches package-lock.json . GitHub shows you 4,000 lines of churned resolved URLs and integrity hashes. You scroll, your e…
Socket Security实时监控开源依赖中的恶意行为，尤其能发现Postinstall自动安装脚本投毒，保护供应链安全
IT之家 6 月 7 日消息，网络安全公司 Socket 研究团队发文，透露有黑客利用“Postinstall”自动安装脚本发起供应链攻击，目前已污染超过 700 个 GitHub 公开代码库。 Socket 表示，黑客在此次攻击事件中首先对 GitHub 多个上游代码仓库动手，悄悄修改 packa…