
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
github.com/getzep/zep-go
Advanced tools
Documentation |
LangChain |
Discord
www.getzep.com
The Zep Go library provides convenient access to the Zep Cloud API from Go.
This module requires Go version >= 1.13.
Run the following command to use the Zep Go library in your module:
go get github.com/getzep/zep-go
import (
"github.com/getzep/zep-go"
zepclient "github.com/getzep/zep-go/client"
"github.com/getzep/zep-go/option"
)
client := zepclient.NewClient(
option.WithAPIKey("<YOUR_API_KEY>"),
)
_, err = client.Memory.Add(ctx, "session_id", &zep.AddMemoryRequest{
Messages: []*zep.Message{
{
Role: zep.String("customer"),
Content: zep.String("Hello, can I buy some shoes?"),
RoleType: zep.RoleTypeUserRole.Ptr(),
},
},
})
memory, err := client.Memory.Get(ctx, "session_id", &zep.MemoryGetRequest{
MemoryType: zep.MemoryGetRequestMemoryTypePerpetual.Ptr(),
})
This library models optional primitives and enum types as pointers. This is primarily meant to distinguish
default zero values from explicit values (e.g. false for bool and "" for string). A collection of
helper functions are provided to easily map a primitive or enum to its pointer-equivalent (e.g. zep.Int).
A variety of request options are included to adapt the behavior of the library, which includes
configuring authorization tokens, or providing your own instrumented *http.Client. Both of
these options are shown below:
client := zepclient.NewClient(
option.WithAPIKey("<YOUR_API_KEY>"),
option.WithHTTPClient(
&http.Client{
Timeout: 5 * time.Second,
},
),
)
These request options can either be specified on the client so that they're applied on every request (shown above), or for an individual request like so:
_, _ = client.Memory.Get(ctx, "session_id", &zep.MemoryGetRequest{}, option.WithAPIKey("<YOUR_API_KEY>"))
Providing your own
*http.Clientis recommended. Otherwise, thehttp.DefaultClientwill be used, and your client will wait indefinitely for a response (unless the per-request, context-based timeout is used).
The Zep Go client is instrumented with automatic retries with exponential backoff. A request will be retried as long as the request is deemed retriable and the number of retry attempts has not grown larger than the configured retry limit (default: 2).
A request is deemed retriable when any of the following HTTP status codes is returned:
You can use the option.WithMaxAttempts option to configure the maximum retry limit to
your liking. For example, if you want to disable retries for the client entirely, you can
set this value to 1 like so:
client := zepclient.NewClient(
option.WithMaxAttempts(1),
)
This can be done for an individual request, too:
_, _ = client.Memory.Get(ctx, "session_id", &zep.MemoryGetRequest{}, option.WithMaxAttempts(1))
Structured error types are returned from API calls that return non-success status codes. For example, you can check if the error was due to a bad request (i.e. status code 400) with the following:
_, err := client.Memory.Get(ctx, "session_id", &zep.MemoryGetRequest{})
if err != nil {
if badRequestErr, ok := err.(*zep.BadRequestError);
// Do something with the bad request ...
}
return err
}
These errors are also compatible with the errors.Is and errors.As APIs, so you can access the error
like so:
_, err := client.Memory.Get(ctx, "session_id", &zep.MemoryGetRequest{})
if err != nil {
var badRequestErr *zep.BadRequestError
if errors.As(err, badRequestErr) {
// Do something with the bad request ...
}
return err
}
If you'd like to wrap the errors with additional information and still retain the ability
to access the type with errors.Is and errors.As, you can use the %w directive:
_, err := client.Memory.Get(ctx, "session_id", &zep.MemoryGetRequest{})
if err != nil {
return fmt.Errorf("failed to get memory: %w", err)
}
While we value open-source contributions to this SDK, this library is generated programmatically. Additions made directly to this library would have to be moved over to our generation code, otherwise they would be overwritten upon the next generated release. Feel free to open a PR as a proof of concept, but know that we will not be able to merge it as-is. We suggest opening an issue first to discuss with us!
On the other hand, contributions to the README.md are always very welcome!
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.