
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@calumk/editorjs-codecup
Advanced tools
npm i @calumk/editorjs-codecup
https://cdn.jsdelivr.net/npm/@calumk/editorjs-codecup@latest
This is an EditorJs wrapper for CodeCup - A lovely lightweight zero-dep code formatter
It was built to be an improvement on :

import EditorJS from '@editorjs/editorjs';
import editorjsCodecup from '@calumk/editorjs-codecup';
var editor = new EditorJS({
// ...
tools: {
...
code : editorjsCodecup
},
});
The plugin provides two ways to handle language selection:
Free-form Language Input: By default (when no languages are configured), users can enter any valid Prism.js language key through a text input.
Predefined Language Dropdown: When you provide a languages configuration, users can select from a predefined list of languages through a dropdown menu.
You can configure the language selection behavior using these options:
Provide a custom mapping of Prism.js language keys to their display names:
var editor = new EditorJS({
// ...
tools: {
code: {
class: editorJsCodeCup,
config: {
languages: {
javascript: "JavaScript",
python: "Python",
java: "Java",
cpp: "C++",
csharp: "C#",
go: "Go",
none: "Plain Text",
}
}
}
},
});
If you want to allow both predefined language selection AND free-form language input, use the forceShowLanguageInput option:
var editor = new EditorJS({
// ...
tools: {
code: {
class: editorJsCodeCup,
config: {
languages: {
javascript: "JavaScript",
python: "Python",
// ... other languages
},
forceShowLanguageInput: true // Shows both dropdown and language input
}
}
},
});
Refer to Prism.js supported languages for the available language mappings.
The data imported/exported from the block is as follows:
| Name | Description |
|---|---|
| code | The code that is displayed in the editor, with line breaks |
| language (optional) | The programming language |
| showlinenumbers (optional) | Will show/hide the line numbers (Default true) |
| showCopyButton (optional) | Will show/hide the copy button (Default true) |
Since language and linenumbers are optional, existing code blocks can safley use this plugin
@calumk
@keertyverma
FAQs
Codecup, for EditorJS
The npm package @calumk/editorjs-codecup receives a total of 271 weekly downloads. As such, @calumk/editorjs-codecup popularity was classified as not popular.
We found that @calumk/editorjs-codecup demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.