
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@discipl/law-reg
Advanced tools
Library capable of interpreting published FLINT models of official law and regulation and support actors with their self-sovereign ids to effectively perform the tasks identified in them through the Discipl software stack.
This library creates self-sovereign ids in relation to needs automatically and stores key information at a discipl-core supported platform (probably some local or private distributed wallet as you want to keep this private)
This library also enables the possibility to escalate towards an escalation process (convergent facilitation) if any actor does not agree with the automated process and logic or decisions of other actors.
discipl-law-reg includes a specification for a FLINT model expressed as linked data. For now it is published as verifiable claim with the whole model as a JSON object. The subject of this claim can be used to verify whether the model is official. The model is closely tied to official law and regulations using official jurisdictional references. A FLINT model is created by hand though with a formal method called Calculemus and specific tooling this can be made straightforward and possibly automated to a certain extend (ongoing research).
More information and how to install the used tools and techniques which are named in the instructions, can be found at the Discipl main page.
And for more detailed information about the Law-Reg project, click here
NOTICE: highly experimental - expect the content to change considerably
These instructions will get you a copy of the project up and running on your local machine for development and testing purposes.
In the projects root folder:
npm install
Also in the projects root folder:
npm test
After completing these steps, you have to see the result of the tests declared inside the test folder.
FAQs
Discipl Law and Regulation Compliance Library
We found that @discipl/law-reg demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.