
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@contentacms/contentajs
Advanced tools
A nodejs server that proxies to Contenta CMS and holds custom code.
ContentaJS is a project that integrates with Contenta CMS to provide an high performing headless CMS. It also provides a nodejs application where to host your Server Side Rendering and custom code integrations.

IMPORTANT: this project is meant to be a starting kit for the node integration of your application based on Contenta CMS. We do not provide upgrade paths or backwards compatibility. The model for this is Fork & Go.
Contenta CMS (aka the Drupal part) is designed to serve your project’s content. ContentaJS (aka the node.js part) is designed to serve the requests to your client side applications. Some of those requests will end up requesting data from Contenta CMS, others won’t.
You may need ContentaJS because for many reasons you will end up needing a node.js server for your project anyways. You may as well use an opinionated and optimized starter kit that will solve many of your needs without effort.
If your API needs to aggregate data for use on the front-end from other services you should not use PHP for that. That is because, in practice, all I/O in Drupal is blocking and the performance of these tasks is usually very poor.
Examples of this are:
In these situations you will want to treat Contenta CMS just as any other microservice. Then you will need a server, like this one written in node.js, to orchestrate the different microservices.
Chances are that you are building a website as part of your digital project. In most cases you will be using a front-end framework like React, Vue, Angular, etc. All of those frameworks recommend using server-side rendering for many reasons. In order to implement server-side rendering you will need a node.js server.
You can use this node.js server (aka ContentaJS) to implement server-side rendering on.
Your LAMP stack (or alternative) runs your Contenta CMS installation. We all know how flexible and powerful Drupal is. But at the same time it is not great from a performance point of view. In fact it can rapidly become your bottleneck.
With ContentaJS you can reduce the load in your LAMP stack. This is because you don’t even need to hit this stack to access cached responses. ContentaJS will fetch the data from cache, and will only check with Drupal when there is no cache. That reduces greatly the amount of requests Apache needs to process. This reduces the load on Drupal, hence improving performance overall.
ContentaJS integrates transparently with Contenta CMS and can analyze requests that will fail in Drupal. When that happens the request never hits Drupal thus reducing the load there. Examples of this are: a request to a non-existing resource, a request that contains a payload that doesn’t validate against the schema of the resource, etc.
Other server tasks like executing actions on cron, or sending emails, etc. can be done in this node.js server (and/or the machine running it) instead of on the LAMP stack.
This section is still under development.
The main features of this project cover:
In order to install ContentaJS you will need to meet the following requirements:
nodejs ^8.11.1 or higher. This corresponds to lts/carbon.See the installation instructions.
This is a dumping ground of notes. This section will disappear eventually, it’s just meant to save ideas for documentation to process some other time.
@contentacms/contentajs is MIT licensed.
FAQs
A nodejs server that proxies to Contenta CMS and holds custom code.
We found that @contentacms/contentajs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.