npm Attack Splits Malicious Logic Across Packages to Target Alibaba Devs
🌰Lizi Frontend Tech Weekly Issue 143 (2026.08.17 - 2026.08.23): Browse the latest frontend news of the week, learn from excellent articles at home and abroad, and let's keep our curiosity about the frontend.
📰 Tech News
npm Attack Incident: Security firm Socket recently disclosed an npm supply chain attack targeting Alibaba's development environment. The attackers registered a batch of packages with names highly similar to Alibaba's internal private packages. These packages did not simply stuff all malicious code into a single module; instead, they split the attack logic across multiple dependencies and remote configurations. Some modules even appeared to have normal functionality when viewed in isolation, such as parsing configurations or executing expressions, but when multiple components were combined, they formed a complete attack chain.
Bun 1.4: Bun 1.4 has been released, with improved Node.js compatibility, significantly reduced memory usage, and a large number of newly added built-in APIs.
📒 Technical Articles
Why Does the Same Code Always Have Bugs on Safari?: Having coded in this field for nearly a decade, the author has experienced countless blood-pressure-spiking production incidents. But if you ask the author which bug is the most despairing? It's not memory leaks, not request race conditions, but that classic line that makes every frontend engineer's pupils dilate in shock: It works fine on Chrome, but it's broken on Safari.
Is Your Code Getting Messier with Changes? Try Frontend Domain-Driven Design (DDD): Increasing business complexity can easily make code unmaintainable. The article introduces DDD as a solution for expressing business domain knowledge in code and elaborates on the process of implementing DDD on the frontend.
🔧 Dev Tools
- microlighter: A lightweight code highlighting JS library, only 2KB after compression, using CSS's Custom Highlight API.
- Critical CSS Generator: Enter your URL, and this tool will extract the minimal CSS required to render the above-the-fold visible content.
🍞 Code & Life
- How Can a Senior Frontend Developer Gracefully Reject Unreasonable Product Requirements?: After you've broken down the risks using technical language and provided an alternative solution, never say "So we should use Plan B." Instead, say: "The risks of Plan A are these, and the costs of Plan B are those. Which one do you think fits our current business stage better?"
🚀🚀🚀 The above news and articles are selected from common newsletters, such as JavaScript Weekly, etc. The newsletter content will also be continuously optimized and improved. I hope you like it.
💖 Welcome to follow the WeChat public account: Lizi Frontend