Untitled

When Second State started in 2019, the major use case for WebAssembly was in the blockchain, to run smart contracts.

“You really need a lightweight environment, a sandbox to run them [blockchains], and Docker — or containers in general — was too heavy for that, because in the span of six seconds, you have to do 1,000 of those,” said Michael Yuan, CEO of Second State.

The Austin-based startup instead focuses on offering support for WasmEdge, a WebAssembly runtime for cloud native, edge and decentralized applications. WasmEdge is open source and an official sandbox project hosted by the Cloud Native Computing Foundation (CNCF), an open source, vendor-neutral hub. WasmEdge is derived from the same standard as WasmTime, a Bytecode Alliance project.  Essentially, they’re the same, Yuan told The New Stack.

“However, I think our distinct offerings or features are the development toolings and APIs around that,” Yeon said. “For instance, we are embedded into Docker desktop so every Docker user gets a copy of WasmEdge instance.”

Applications can be written in either Rust or JavaScript and run inside the Wasm container instead of a more traditional Linux container, he added. Kubernetes can manage both types of containers.

Wasm for the Frontend

However, when it comes to using Wasm on the frontend, it’s most often used to support serverless functions, Yuan explained. TikTok, for instance, has deployed Wasm for serverless. In that use case, Wasm is running in the browser. Another more widely deployed use case is providing the frontend with dynamic content from the backend, he said.

“The backend could have services, or nowadays, it’s more common to use serverless functions or microservices,” he told The New Stack.

The building of websites makes use of a wide variety of technologies, but there is no question that Node.js is indeed the sweetheart of the developer community.

Node.js developers for hire are a highly sought-after asset, but it’s also important to take note of the leading frameworks for app development.

But which are the best ones in 2023, and how to hire a Nodejs developer this year? We’ll find out!

First of all, what is Node JS?

Before you start looking for Node JS developers for hire, you need to know what Node.js is.

Node.js is an environment for running JavaScript code that gives developers the ability to build applications that run on servers.

Because it is cross-platform and open source, developers may use it to construct scalable apps that can run on any platform, including Windows, Mac, and Linux servers.

JavaScript is used in the development of Node.js apps, and the Node.js runtime, which is based on the V8 JavaScript engine that Google Chrome utilizes, is required for the applications to function correctly.

Node.js has a straightforward event-driven programming architecture, which makes it very easy to create programs that can run multiple tasks in parallel.

Real-time online applications, such as chatrooms or multiplayer games, find Node.js a perfect platform because its applications can manage tens of thousands of concurrent connections with very little overhead.

In addition, the non-blocking I/O mechanism of Node.js makes it simple to construct practical network applications like web crawlers and RESTful API servers.

Of course, you should be aware that Node js isn’t popular without a reason. There are a couple of different types of frameworks, all suited for different needs.

Different types of Node JS frameworks

In case you need to hire Node JS programmers, you should know the exact needs of your project, and the tasks you assign employees. Why? Because there are several types of Node.js frameworks.

There are a lot of capabilities included into Node.js that may be used to construct web applications. It is able to employ a variety of different frameworks, which is one of the most crucial aspects.

Three primary types of frameworks may be built with Node JS: an HTTP server, an MVC, and a REST API.

HTTP server frameworks offer an organizational method for your code and a path for HTTP requests to take. In addition, they come equipped with functions such as session management and error handling already pre-installed.

Web applications that process a significant amount of data can benefit from the structure that MVC frameworks provide. In most cases, they are equipped with in-built templating engines and support for popular databases like MySQL and MongoDB.

REST API frameworks are intended to develop application programming interfaces (APIs) that are usable by other devices or computer systems.

Authentication, rate limitation, and caching are just a few of the features that are included with them.

So if you hire a Node JS developer, they’ll most likely use one of the popular frameworks. Let’s see which they are.

Most popular Node.js frameworks

Most companies hire Node JS experts who are acquainted with these frameworks, so it’s worth noticing. But which are the most prominent names?

Express.js

Express.js is a popular minimalist web framework for Node.js. It provides a set of robust features for building web applications and APIs, making it easy to create routes, handle requests, and deliver responses.

One of the key benefits of using Express.js is its simplicity. It is lightweight and easy to use, making it a good choice for small projects.

It also has a large and active community, which means you can find a lot of support and resources online.

However, Express.js is a minimalistic framework and does not come with many features out of the box. This means you will have to use third-party libraries or build your own solutions for certain functionality.

Despite this, Express.js is still a very popular choice among Node.js developers and is used in many production applications.

Koa.js

Koa.js is a web framework designed by the team behind Express.js. It is built on top of Node.js and uses async functions as middleware, making it more lightweight and efficient than Express.js.

One of the key features of Koa.js is its use of async functions, which allows you to write middleware and routes that are easy to understand and maintain.

It also has a small footprint, making it a good choice for building microservices and serverless applications.

However, Koa.js is a relatively new framework with a different level of support and resources than some of the more established frameworks like Express.js.

It also requires a deeper understanding of async/await and Promises in JavaScript, which may be a challenge for developers unfamiliar with these concepts.

Despite these limitations, Koa.js is a powerful and popular choice for building web applications and APIs with Node.js.

Sails.js

A contemporary MVC framework for Node.js called Sails.js makes it simple to create unique, enterprise-level applications.

Because it is made to look like the well-known MVC style used by frameworks like Ruby on Rails, it is simple for developers to pick up.

Using Sails.js has many advantages, one of which is its emphasis on convention over configuration. This indicates that it includes a set of patterns that facilitate the speedy development of applications without requiring extensive design.

You may discover a lot of help and information online because of its sizable and vibrant community.

Sails.js can be a bit opinionated; thus, it might not be the ultimate solution for projects that require a lot of customization.

It also has a more extensive code base than more straightforward frameworks, like Express.js, which can make it less appropriate for little-funded or resource-constrained projects.

Netlify has acquired Gatsby Inc, the San Francisco based company which is also steward of the open source Gatsby.js framework. Netlify has promised to be “good stewards of the open source project” but is focused on other parts of the platform, in particular the plugin ecosystem and the GraphSQL API called Valhalla Content Hub.

The Gatsby framework, first released in 2015, is a static site generator built with React, GraphQL (a query language for APIs) and Node.js. It is open source on GitHub under the MIT license.

Gatsby Inc operates the commercial Gatsby Cloud, for hosting Gatsby web sites, as well as other features such as live preview, server-side functions, an Edge network, and since November 2022, the Valhalla Content Hub which the company described as “a unified GraphQL layer for any web application.” Valhalla does not have to be used with Gatsby but can work with any framework, including favorites like Next.js and Svelte.

Gatsby also supports plugins which integrate Gatsby’s GraphQL layer with other data sources such as headless content management systems, as well as adding functionality such as progressive images, analytic libraries, or RSS feeds.

Netlify intends to integrate the Gatsby Cloud with its own hosting platform, as well as improving the cross-framework appeal of the plugins and Valhalla hub.

Gatsby is not the most fashionable platform today, though according to the large State of JavaScript 2022 survey it is the second most-used rendering framework after Next.js – though only about half as popular. Ask developers what they are interested in though, and Gatsby declines to 7th place. Nevertheless, its reputation for performance is good and it has a foothold in the enterprise market – and the State of JavaScript survey results site itself is “built with Gatsby.” According to today’s press release, Gatsby Inc has been growing revenue “more than 100% year over year”.

Netlify CEO Matt Biilmann told DevClass: “As a front-end framework, Gatsby has found a sweet spot in large content driven sites for midmarket to enterprise customers, typically with more than one content source. We’ll be good stewards of the open source project, but it’s not the focus of our acquisition. What set Gatsby apart was their source plugin ecosystem, giving developers an easy way to get content and data into their UI. Their new Valhalla Content Hub product line is built on top of this and makes the source plugins available to any modern framework, whether you’re using Next, Astro, Remix or the like. We see it as a strong way to increase the platform’s reach and bring the power of its content orchestration to all Netlify projects, no matter which framework or tools developers employ.”  

At some companies, “business as usual” means doing the same thing over and over because it works and grows the business incrementally. At others, it means taking big swings to spark big growth, with employees challenged to solve new problems and take on ambitious projects. The tech companies featured here fall into the latter camp and all have major aspirations for 2023.

Take Ball Aerospace, whose employees are working on a NASA mission to monitor hourly air pollution across North America. At Axon, which creates hardware and software for law enforcement, fire departments and emergency services providers, the company’s tech team is diving into multi-modal artificial intelligence. Over at Uber, the Uber Eats team is doubling down on its efforts to integrate sign-ups for its service directly into restaurant point-of-sale systems.

These three companies are all hiring, as are the twelve others featured here. Continue reading to hear from leaders at each about their company goals for the year and the cities they’re recruiting in.

What are your growth plans for 2023? What new product, feature or project are you most excited about?

“Uber Eats partners with more than 825,000 restaurants and merchants in more than 11,000 cities across six continents,” Engineering Manager Purnima Aiyar told Built In. “To help them sign up and get online in a fraction of the time, we recently created a self sign-up flow for point of sales (POS) merchants in the United States and Canada in partnership with Toast and Clover. The new integrations have simplified the onboarding process into just a few clicks, allowing hundreds of thousands of merchants to complete setup and POS configuration faster than before. 

“In 2023, we plan to advance our self sign-up integrations and offer this experience to even more merchants who are looking to streamline delivery options by allowing them to sign up for Uber Eats directly using their existing POS system for a faster and more effortless onboarding experience.”

VS Code is popular – according to StackOverflow 75% of developers use it. As a raw code editor it isn’t particularly impressive, but add to it the huge number of extensions that are available and you can assemble something workable and sometimes even something good. I use it because I can configure it to work with a range of languages in a range of situations on a range of platforms. Personally I’d prefer it if the core extensions were part of a configurable core program, but this is not how things are. Finding extensions is a big problem in terms of knowing who to trust. For most of the time I try to limit my use to well-known extensions, preferably authored by companies I know. Searching the 40K extensions for one that does the job and isn’t just abandonedware or halfstartedware is difficult. Now it seems it is also dangerous.

The problem is that extensions run will the same privileges as the user and there is no sandbox to keep the extension walled up in a prison. Once you realize this you can see how devastating an evil extension might be.

The researchers from Aqua Team Nautilus decided to see if the threat was real. They created an extension that copied the look and feel of the Prettier code formatter and entered it into the Marketplace – the official source of extensions. What they created looks identical to the real entry until you notice that the URL is pretier – i.e. it’s a case of typosquatting. Typosquatting is where you make use of user’s inability to type accurately 100% of the time to get them to visit web pages which differ from the real thing by a spelling or punctuation error. As a dyslexic programmer you can see that I’m personally very vulnerable to this problem. And while I take extra care I don’t think I’d ever spot it.

The problem is made worse by the fact that the extension name doesn’t need to be unique – it’s a display name. Other details are also easy to duplicate, including the project details and publisher. Harder to duplicate are the Unique Identifier which,yes, has to be unique, but again typosquatting to the rescue and esbenp.prettier-vscode becomes  espenp.prettier-vscode – which is identical from my dyslexic point of view,. Of course, the number of installs and ratings can’t be spoofed but as people download the faux extension they both go up.

The researchers then go on to point out that Microsoft’s attempts at verifying extensions isn’t particularly convincing. For examp,e the blue Verified Author tick simply means that the author owns a domain – any domain. From here the attacker can opt to show the display name complete with the blue tick for the author’s name.

So did it work? Were real programemrs, some of whom are not dyslexic and hence not overly vulnerable to typosquatting, fooled?

Yes they were.

“In just under 48 hours, we got more than a thousand installs by active developers from all around the world! Now, imagine a real attacker (which would give the extension much more time to be active thus gain more credibility), with a real malicious extension, installed on many developers compromising many organizations. The impact of this is critical.”

The researchers also point out that extensions make use of Node.js NPM as a package manager and any problems here will trickle down. They also point out that the same problems could occur with Visual Studio and Azure DevOps, but didn’t pursue this angle.

The Google reCaptcha Enterprise for Laravel is a package that provides easy configuration of reCaptcha and a handy validation rule to verify your user token scores.

Here’s an example of how you can use this package to validate the user’s Recaptcha score using the provided validation Rule class:

use Illuminate\Foundation\Http\FormRequest;use Oneduo\RecaptchaEnterprise\Rules\Recaptcha; class TestRequest extends FormRequest{ public function rules(): array { return [ 'g-recaptcha-response' => [ 'required', new Recaptcha() ], ]; }  public function authorize(): bool { return true; }}

When validating a reCaptcha token, you need to configure a score threshold acceptable for considering the user as valid. You can customize your app’s score based on reCaptcha data using the provided configuration option in this package:

// config/recaptcha-enterprise.phpreturn [ 'score_threshold' => 0.7, // ...];

You can get started with this package on GitHub at oneduo/laravel-recaptcha-enterprise and install it via composer:

Check Point and Phylum are warning of recently identified NPM and PyPI packages designed to steal user information and download additional payloads.

Taking advantage of the broad use of open source code in application development, malicious actors are increasingly relying on software supply chain attacks to infect both developers and users with malware.

According to an October 2022 Sonatype report, the number of software supply chain attacks observed in 2022 was 633% higher compared to the previous year.

Node.js (NPM) and Python (PyPI) repositories are the preferred targets for malicious packages, mainly because code execution can be triggered during package installation, Check Point notes.

In a new report, the cybersecurity firm says it has identified two malicious Python packages that fit this description.

The first of them, Python-drgn, was uploaded to PyPI on August 8, 2022. Relying on typo-squatting, the package is meant to attract users who are looking for Drgn, a debugger with an emphasis on programmability.

The malicious package consists of a single setup.py file, which automatically runs during package installation and which contains malware. When executed, the malware stores the username, the working directory’s path, and networking information, and sends it to a remote, private Slack channel.

The second malicious package is named bloxflip, typosquatting the Bloxflip.py package, which is an API wrapper for bloxflip.com.

The malicious code within bloxflip disables Windows Defender to prevent detection, then fetches an executable from a remote server, creates a subprocess, and executes the malicious payload.

Phylum, on the other hand, says it has discovered over 100 malicious NPM packages that contain the payload in package.json’s postinstall script, which is executed during package installation.

The malicious script harvests various types of information from the infected system (including hostname, username, working directory, and package name and version) and sends it to an attacker-controlled server.

The software supply chain security firm also observed the package authors changing the remote server address over the course of 24 hours.

At X-Netics, our long-term vision is to be recognized as a leading software development company that provides innovative solutions for businesses of all sizes.

At X-Netics, we believe that every business has the potential to achieve great things, but sometimes they just need the right tools to unlock that potential. That's where we come in. We are a team of software development experts who are passionate about creating innovative solutions that help businesses to grow and succeed.

X-Netics has a team of experienced developers and project managers who are dedicated to understanding your unique needs and delivering a product that exceeds your expectations.