
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@haprompt/html
Advanced tools
@haprompt/htmlThis package exports utility functions for converting Haprompt -> HTML and HTML -> Haprompt. These same functions are also used in the haprompt-clipboard package for copy and paste.
Full documentation can be found here.
// When converting to HTML you can pass in a selection object to narrow it
// down to a certain part of the editor's contents.
const htmlString = $generateHtmlFromNodes(editor, selection | null);
First we need to parse the HTML string into a DOM instance.
// In the browser you can use the native DOMParser API to parse the HTML string.
const parser = new DOMParser();
const dom = parser.parseFromString(htmlString, textHtmlMimeType);
// In a headless environment you can use a package such as JSDom to parse the HTML string.
const dom = new JSDOM(htmlString);
And once you have the DOM instance.
const nodes = $generateNodesFromDOM(editor, dom);
// Once you have the haprompt nodes you can initialize an editor instance with the parsed nodes.
const editor = createEditor({ ...config, nodes });
// Or insert them at a selection.
$insertNodes(nodes);
FAQs
This package contains HTML helpers and functionality for Haprompt.
We found that @haprompt/html demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.