
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
一个简单的基于Web的目录查看工具,展示如何使用 pnpm workspace + Koa + React 构建可通过 npx 使用的CLI工具。
npx 2dev
npm install -g 2dev
# 或
pnpm install -g 2dev
# 使用
2dev
pnpm install
开发模式下,前端和后端分别运行:
# 同时启动前后端
pnpm dev
# 或分别启动
pnpm dev:frontend
pnpm dev:backend
pnpm build
# 构建并启动生产环境
pnpm build
pnpm start
登录 npm
npm login
修改包名(如果 2dev 已被占用)
编辑 package.json,修改 name 字段为可用的包名。
发布
npm publish
注意:发布时会自动执行 prepublishOnly 脚本构建项目。
测试发布的包
npx your-package-name
2dev/
├── packages/
│ ├── frontend/ # React + Vite前端
│ └── backend/ # Koa2后端API
├── bin/
│ └── cli.js # CLI入口文件
├── pnpm-workspace.yaml # pnpm workspace配置
└── package.json # 根package.json(CLI配置)
GET /api/health - 健康检查GET /api/files - 获取当前目录文件列表(排除隐藏文件)MIT
FAQs
A simple web-based directory listing tool - example usage of remote terminal
We found that 2dev demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.