
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@jpweeks/typedarray-pool
Advanced tools
A global pool for typed arrays.
var pool = require("typedarray-pool")
//Allocate a buffer with at least 128 floats
var f = pool.malloc(128, "float")
// ... do stuff ...
//When done, release buffer
pool.free(f)
npm install typedarray-pool
var pool = require("typedarray-pool")
pool.malloc(n[, dtype])Allocates a typed array (or ArrayBuffer) with at least n elements.
n is the number of elements in the array
dtype is the data type of the array to allocate. Must be one of:
"uint8""uint16""uint32""int8""int16""int32""float""float32""double""float64""arraybuffer""data""uint8_clamped""buffer"Returns A typed array with at least n elements in it. If dtype is undefined, an ArrayBuffer is returned.
Note You can avoid the dispatch by directly calling one of the following methods:
pool.mallocUint8pool.mallocUint16pool.mallocUint32pool.mallocInt8pool.mallocInt16pool.mallocInt32pool.mallocFloatpool.mallocDoublepool.mallocArrayBufferpool.mallocDataViewpool.mallocUint8Clampedpool.free(array)Returns the array back to the pool.
array The array object to return to the pool.Note You can speed up the method if you know the type of array before hand by calling one of the following:
pool.freeUint8pool.freeUint16pool.freeUint32pool.freeInt8pool.freeInt16pool.freeInt32pool.freeFloatpool.freeDoublepool.freeArrayBufferpool.freeDataViewpool.freeUint8Clampedpool.freeBufferpool.clearCache()Removes all references to cached arrays. Use this when you are done with the pool to return all the cached memory to the garbage collector.
(c) 2014 Mikola Lysenko. MIT License
FAQs
Reuse typed arrays
We found that @jpweeks/typedarray-pool demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.