
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@cipscis/pubsub
Advanced tools
Run npm install @cipscis/pubsub
You will need to install Node.js before working on this package.
git clone https://github.com/cipscis/pubsub.git.npm install to install development dependencies..env file.npm start to run the local server and watch CSS and JS files for changes.This project creates six npm tasks:
npm run server runs a Node.js server on the port specified in the .env file, using Express.
npm run build compiles CSS files using gulp-sass and bundles JavaScript using Webpack.
npm run watch first runs the build task, then watches the relevant directories and reruns the build task if it sees any changes.
npm start runs both the server and watch tasks simultaneously.
npm test task compiles any TypeScript and runs any configured test suites using Jasmine.
npm run prepare first removes directories containing compiled files, then compiles any TypeScript and runs any configured test suites using Jasmine. You should never need to run this task manually, the prepare script runs automatically when npm prepares your package for publishing.
Usually, you will just want to run npm start.
The .env file contains the following environment variables:
PROJECT_NAME (string)If present, used by Express to set up redirects for emulating GitHub Pages.
MODE (string 'development' | 'production')Used by Webpack to determine what optimisations to use and how to generate sourcemaps.
PORT (int)Used by Express to determine which port to use when running a local Node.js server.
An example .env file you can use for development is:
PROJECT_NAME = "pubsub"
MODE = "development"
PORT = "8080"
This file is intended to differ from environment to environment, so it is ignored by Git.
None.
These dependencies are used when working on the project locally.
Node.js: Runtime environment
npm: Package manager
Gulp: Task runner
TypeScript: JavaScript extension for static type checking
Jasmine: Testing framework
@types/jasmine: TypeScript types for Jasmine
gulp-sass: Using the sass compiler with Gulp
Webpack: For JavaScript dependency management, used with Gulp
ts-loader: For compiling TypeScript using Webpack
resolve-typescript-plugin: For using ES Module syntax with Webpack's ts-loader
Express: Running a Node.js server, accessed at http://localhost:<PORT>
Concurrently: Running server and development build tasks concurrently
These dependencies are used for deploying the project to GitHub Pages.
checkout: Used to check out the repository to a workspace so it can be built
Deploy to GitHub Pages: Used to deploy the project to GitHub pages once it has been built
FAQs
An implementation of the publish-subscribe pattern.
We found that @cipscis/pubsub demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.