
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@hexelnet/sniffy
Advanced tools
A simple function for debugging stuff like promise chains, streams and other pipeline-like thingees. It just creates a function that console logs whatever is passed to it and then returns that value. (Compatible with React Native. This does the same as M
A simple function for debugging stuff like promise chains, streams and other pipeline-like thingees. It just creates a function that console logs whatever is passed to it and then returns that value
This package is originally created by MPJ.
I only copied it and made it compatible with react-native by removing the methods that require the util or fs module. I'm so lazy I even copied his README file :)
If you're not working in a React Native project your better of installing the supersniff module:
And if you're looking for an AWESOME programming show on youtube you should definitely check out his channel on https://www.youtube.com/channel/UCO1cgjhGzsSYb1rsB4bFe4Q
Example:
const sniffy = require('sniffy')
//or
import sniffy from 'sniffy'
fetch(`http://myapi.com/users/${username}.json`))
.then(response => response.json())
.then(sniffy) // Will console.log out the parsed json, and return the value,
// effectively passing it on to the next .then
.then(user => Promise.all(user.friends.map(friend => getFriend(friendId))))
.then(friends => /* do even more stuff here */)
Lets say that you have a promise chain that looks like this ...
getData()
.then(transformData)
.then(sortData)
... and you are debugging an issue that makes you want to inspect what the data looks like after the transformData operation, but BEFORE the sortData operation. No matter if you want to do this by breakpoint or console.log, you need to wrap transformData in a multiline functions:
getData()
.then(x => {
console.log(x) // alternatively, breakpoint on the line below
return transformData(x)
})
.then(sortData)
It's not a huge hassle, but I found myself doing it a LOT, and with sniffy there is a lot less typing:
getData()
.then(transformData)
.then(sniffy)
.then(sortData)
Yes, this is stupidly simple, but I've found myself writing this function 40000 times now so I want it on npm, OK? OK!?????
Sniffy will log to console with a [SNIFFY] prefix but if you want to override it like this:
const sniffy = require('sniffy')
//or
import sniffy from 'sniffy'
fetch(`http://myapi.com/users/${username}.json`)
.then(response => response.json())
.then(sniffy.tag('MYTAG'))
This is available is only the supersniff package
This is available is only the supersniff package
This is available is only the supersniff package
FAQs
A simple function for debugging stuff like promise chains, streams and other pipeline-like thingees. It just creates a function that console logs whatever is passed to it and then returns that value. (Compatible with React Native. This does the same as M
We found that @hexelnet/sniffy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.