
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@b4dnewz/temp
Advanced tools
A node utility to handle temporary files and folders
Install the project using your favourite package manager.
npm install @b4dnewz/temp
Load inside your project all together or separate functions.
import * as temp from "@b4dnewz/temp";
// or
import {file, fileSync, dir, dirSync} from "@b4dnewz/temp";
Then create any temporary file you need in your application or your tests.
// create a temporary file
// es: /tmp/e6ba9fff240bde04897f/5fb6aa4e9ac8ccf10e2f
temp.file()
// create a temporary file in sync way
temp.fileSync()
// create a temporary directory
// es: /tmp/3c34454971179fc20e99/29d72d3cb2386b904afe
temp.dir()
// create a temporary directory in sync way
temp.dirSync()
it("should create a temporary file", async () => {
const tmpFile = await temp.file()
// do whatever you need with the file
await tmpFile.remove()
})
Later on, when you have done with it, just release it.
// will remove the temporary file
tmpFile.remove()
// will remove the temporary directory
// even if has content in it
// such as other temporary files
tmpDir.remove()
This project provide an online documentation automatically generated with TypeDoc, but a very deep documentation with real world usage examples is coming soon, stay tuned.
git checkout -b my-new-feature)git commit -am 'Add some feature')git push origin my-new-feature)FAQs
A node utility to handle temporary files and folders
We found that @b4dnewz/temp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.