
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@composerjs/virtual-file
Advanced tools
VirtualFile is an object that represents a Buffer and it's metadata. Though this object is comparable to a Vinyl object, the intention is that instances of `VirtualFile` are truly simple, and flat metadata objects. It does not provide output helpers. It's just metadata and the Buffer content.
npm i -S @composerjs/virtual-file
import fs from 'fs';
import { VirtualFile } from '@composerjs/virtual-file';
const file = VirtualFile.Factory({
path: './package.json',
content: fs.readFileSync('./package.json'),
encoding: 'utf8',
tags: ['npm-package']
});
console.info(file.toString()); // '{"name":"@composerjs/virtual-file"...
console.info(file.mediaType); // 'application/json'
console.info(file.byteLength) // 341
VirtualFile.Factory({options})Constructs a new instance of a VirtualFile where an instance represents
a single file. All attributes of a VirtualFile are readonly so once
constructed the properties cannot be changed.
optionsoptions.path: string RequiredRelative or absolute path location of the file.
options.content: Buffer RequiredBuffer of the file.
options.encoding: string OptionalEncoding of the buffer.
Default: utf8
options.tags: string[]An array of strings useful for adding additional metadata descriptions
to an instance of VirtualFile.
VirtualFile.IsVirtualFile(file: VirtualFile): booleanReturns true if the provided value is an instance of VirtualFile.
file.toString(): stringReturns the Buffer as a string. Internally this uses StringDecoder, but
only when encoding is set to utf8 or utf16
file.toJSON(): objectCalled when an instance of VirtualFile has been JSON.stringify()'d.
This returns a flat object of picked properties from the instance.
Use file.toObject() instead as semantically it's more appropriate.
file.toObject(): objectAlias of file.toJSON().
file.extend(file: VirtualFile): voidExtends the instance with values from the provided VirtualFile
instance.
file.clone(): VirtualFileReturns a clone of the VirtualFile instance.
file.content: BufferBuffer representation of the file content.
file.byteLength: numberAlias of this.content.byteLength. Returns the Buffer size in bytes.
Example: 341
file.encoding: string file encoding string
Example: utf8, utf16, buffer
file.tags: string[]An array of strings useful for adding additional context about the file
the instance of VirtualFile is representing.
At the moment tags are just an array of strings to provide additional context for the file.
Example: \['package-json'\]
file.path: stringComplete file path supplied via constructor.
Example: dir/file.txt
file.name: stringName of the file via via path.parse().
If path is a URL name will be a SLD i.e. google in google.com
Example: file
file.isURL: booleanIf the provided path is a valid URL this will be true.
Default: false
file.ext: stringFile extension via path.parse().
If path is a URL ext will be TLD i.e. .com in google.com
Example: .txt
file.absolute: stringAbsolute path via path.resolve().
Example: /home/user/dir/file.txt
file.dir: stringDirectory of file via path.parse()
Example: /home/user/dir
file.base: stringBase name of file via path.parse()
Example: file.txt
file.root: stringRoot path via path.parse()
Example: /
file.mediaType: string | undefinedMedia Type (formerly called Mime Type) of the file.
This value may not be set.
Example: application/json
file.contentType: string | undefinedThe Content-Type entity header value used in HTTP transactions.
This value may not be set.
Example: application/json
[Symbol.toStringTag]: stringSet by default in all instances. Calls to Object.prototype.toString.call(file) for
instances of VirtualFile will return the constant string value.
Default: VirtualFile
nodejs.util.inspect.custom: stringComparable to [Symbol.toStringTag] this symbol is used by node's
util.inspect.
FAQs
file metadata
We found that @composerjs/virtual-file demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.