Archive for category: Node.js

Alan Seiden

Safer npm installation is on the way for Node.js (and all JavaScript)

/0 Comments/in /by

JavaScript’s package manager, npm, has been in the news lately for allowing supply-chain risks. By default, npm trusts a module’s install scripts, running them automatically. In a recent compromise of Red Hat npm packages, attackers used malicious install scripts to spread a credential-stealing worm.

Some packages do need to run installation scripts. The odbc module, for example, uses node-gyp during installation to compile the driver. On IBM i and other platforms, that compile step may be necessary.

npm’s response

Starting with npm 11.16.0, npm will warn about install scripts that have not been explicitly approved. In npm 12, unapproved scripts are expected to be blocked by default.

If you try to install a package with install scripts under npm 11.6.0, you will receive a warning such as this:

For legitimate packages that need install scripts, the fix is to run npm approve-scripts. For example:

After approval, npm will remember that the package should be allowed to run its install script:

In our case, approving odbc is appropriate because its installation runs node-gyp, which is needed to compile the ODBC driver.

We suggest updating npm now and reviewing any warnings before npm 12 makes this behavior more strict.

To upgrade npm to the latest version:

Thank you to IBM’s Korinne Adler for alerting us to this change.

For more open source support and security help

Contact us for professional open source support and security guidance.

Alan Seiden

What the Shai-Hulud npm Worm Means for Node.js Developers

/0 Comments/in , /by

node.js ibm iThe Node.js ecosystem has been disrupted by self-replicating malware called Shai-Hulud.

In September 2025, researchers found that Shai-Hulud had infected more than 500 npm packages, including some from trusted maintainers. The worm did not just publish a few bad versions. It spread automatically, using stolen credentials to infect other packages owned by the same developer.

Read more →

Richard Schoen

Integrate Python, Node, PHP, etc. with CL & RPG on IBM i – 2023 Update

/0 Comments/in , , , /by

QSHONIA few years ago I introduced you to my QShell on i utility – QSHONI. QSHONI makes it easy for traditional CL, RPG, and COBOL programs to call Python utilities and other QShell/PASE utility programs (PHP, Node, Java, etc.) and directly use their output. QSHONI opened up a whole new world of integrations to open source apps from RPG, CL, and COBOL.

In this post I will update you on new features that have been added to the QSHONI utilities over the past 12 months.

Read more →

Holly Lacher

Edit IFS Files Using Visual Studio Code for IBM i

/0 Comments/in , , , /by

Code for IBM iVisual Studio Code (VS Code) is a lightweight source code editor that runs on multiple desktops, including Windows, Linux, and MacOS. It provides built-in support for PHP, Node.js, Python, and many other languages and runtimes.

Halcyon Tech’s Code for IBM i extension adds the ability to edit IBM i Integrated File System (IFS) files inside VS Code. It’s easy to get set up to access and edit IFS-based code using this popular editing tool.

In just seven quick steps, you can install VS Code and its Code for IBM i extension and begin working with IFS files stored on your IBM i.

Read more →

Alan Seiden

Install and Use Node.js iToolkit for IBM i

/4 Comments/in /by

node.js ibm iNode.js has joined other popular IBM i open-source technologies, such as PHP and Python, for web application and API development. A server-side runtime for JavaScript, Node.js can run both on IBM i and on other platforms such as Linux.

The Node.js iToolkit lets you leverage your company’s investment in RPG and COBOL business logic while developing front ends and APIs with Node.js. As with Node.js itself, iToolkit can run on your IBM i or can connect to IBM i from your PC or an external web server.

This post explains how to install Node.js and its iToolkit on your IBM i, then use iToolkit to call an RPG service program.

Read more →

Alan Seiden

Tutorial: Integrate Node.js with RPG without a Connector

/0 Comments/in , , /by

Node.js IBM iWe’ve been hearing from clients wondering whether they need commercial connectors to integrate open source technology with Db2, RPG, and COBOL data.

Liam Allan has shown the power of using open source tools that are available to everyone. He recommends accessing IBM i business logic and data using open source tools, without proprietary connectors.

Read more →

Liam Barry Allan

Node.js and IBM i – Getting Started Guide

/0 Comments/in , /by

This guide will outline writing your first Node.js application. Node.js is a packaged version of the V8 Javascript engine, created by Google and shipped in Chromium. Although Node.js is cross-platform, specific tips for IBM i are given in section 8.

MORE
Alan Seiden

Node.js Process Manager PM2 on IBM i

/0 Comments/in , /by

pm2 node.jsTo manage Node.js application processes in production on IBM i, we recommend PM2 Runtime. As stated in PM2’s official documentation, PM2 “…allows you to keep applications alive forever, to reload them without downtime and facilitate common DevOps tasks.”

Read more →

Alan Seiden

Node.js, Ruby and Seiden Group

/0 Comments/in , , /by

node.jsWith IBM’s delivery of open source capabilities on IBM i, Seiden Group has been there to apply the technology to application modernization initiatives. Starting with PHP and the PHP toolkit, then Python, and now Node.js and Ruby, we’ve worked with IBM and customers to flesh out the capabilities of the technology, teach best practices at conferences and directly with clients, and develop award-winning solutions.

Read more →