
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@foxxmd/redact-string
Advanced tools
Redact (replace) part or all of a string with a character.
The other popular packages seem to be restricted to a certain behavior:
This didn't fit my needs. I wanted to be able to control how many characters were replaced as well as leave part of the structure intact for hinting in logging. A prime example being replacing part of an IP address so users can view/post logs which confirm correct settings but don't give away full addresses IE 192.168.1.105 -> **********105
npm install @foxxmd/react-string
import {reactString} from '@foxxmd/redact-string';
console.log(reactString('192.168.1.105', 3)); // 3 is the number of character to leave visible
// *********105
An optional, third argument can be passed that defines how the redact occurs:
export interface RedactOptions {
/**
* Replace characters starting at the start or end of string (default start)
* */
replaceFrom?: 'start' | 'end'
/**
* The character/string that characters are replaced with (default '*')
* */
replaceWith?: string
/**
* Which type of characters to replace in the string (default any)
* */
replace?: 'any' | 'alphanumeric' | 'alpha' | 'numeric'
}
// replace all but last 3 characters
console.log(reactString('192.168.1.105', 3));
// *********105
// replace all but first 3 characters
console.log(reactString('192.168.1.105', 3, {replaceFrom: 'end'}));
// 192**********
// replace all but last 3 characters, numeric only
console.log(reactString('192.168.1.105', 3, {replace: 'numeric'}));
// ***.***.*.105
// replace all but last 5 characters with 'X'
console.log(reactString('superSecretPassword', 5, {replaceWith: 'X'}));
// XXXXXXXXXXXXXXsword
FAQs
Redact part or all of string by replacing character
We found that @foxxmd/redact-string demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.