
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@ecoding/base.env
Advanced tools
基础环境判断
import ugenv from '@ecoding/env';
const clientInfo = ugenv.getClientInfo();
const envInfo = ugenv.getEnvInfo();
(deviceUdID、deviceUdidToken、deviceId、ursAuth)来自客户端约定:旧的 App 是通过 URL 上的 querystirng 传递相关参数的。新版 App 将传参方式改成把参数挂到 window.appInfo 对象上(通过注入 js 脚本的方式)
客户端新开webview时才会注入 deviceUdID、deviceUdidToken、deviceId、ursAuth,如果时webview与webview之间跳转则不生效
// clientInfo
{
os: string;
network: string;
userAgent: string;
systemVersion: string;
iosSystemVersion: string | number;
kaolaVersion: string;
deviceUdID: string | null;
deviceUdidToken: string | null;
deviceId: string | null;
};
// envInfo
{
os: string; // ios | aos | wap
isapp: boolean; // 是否考拉app
isios: boolean; // 是否ios
isaos: boolean; // 是否安卓
iswx: boolean; // 是否微信(包括微信小程序)
isalipay: boolean; // 是否支付宝(包括小程序)
iswapqq: boolean; // 是否qq
iswaptaobao: boolean; // 是否手机淘宝
iswapdingding: boolean; // 是否手机钉钉
iswapweibo: boolean; // 是否微博
iswapyouku: boolean; // 是否优酷
iswapwx: boolean; // 是否微信(仅微信不包括微信小程序)
iswapalipay: boolean; // 是否支付宝(不包括小程序)
isminiwx: boolean; // 是否微信小程序
isminialipay: boolean; // 是否支付宝小程序
isminibaidu: boolean; // 是否百度小程序
isminibd: boolean; // 是否字节跳动旗下小程序
isminitt: boolean; // 是否 今日头条、今日头条极速版 小程序
isminidy: boolean; // 是否抖音小程序
isminixg: boolean; // 是否西瓜视频小程序
isanymini: boolean; // 是否小程序(包含微信、字节跳动旗下小程序、百度、支付宝)
now: 'app' | 'waptaobao' | 'wapdingding' | 'wapwx' | 'wapqq' | 'wapweibo' | 'wapalipay'| 'wapyouku' | 'minialipay' | 'miniwx' | 'minibaidu' | 'minitt' | 'minidy' | 'minixg' | 'wap';
};
FAQs
dev env
We found that @ecoding/base.env demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.