
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@knowledgecode/messenger
Advanced tools
Messenger is a Req/Rep Pub/Sub library for iframes and workers.
Allows messages to be exchanged between ...
via npm:
npm i @knowledgecode/messenger
import { MessengerClient, MessengerServer } from '@knowledgecode/messenger';
ES Modules:
<script type="module">
import { MessengerClient, MessengerServer } from '/path/to/esm/messenger.js';
</script>
Traditional:
<script src="/path/to/umd/messenger.js"></script>
<script>
// It is provided with the global variable name "messenger".
const { MessengerClient, MessengerServer } = self.messenger;
</script>
main.js
import { MessengerClient } from '/path/to/esm/messenger.js';
const messenger = new MessengerClient();
const worker = new Worker('/path/to/worker.js');
(async () => {
await messenger.connect('example', worker);
const answer = await messenger.req('add', { x: 2, y: 3 });
console.log(answer); // => 5
messenger.send('close');
messenger.disconnect();
})();
worker.js
importScripts('/path/to/umd/messenger.js');
const { MessengerServer } = self.messenger;
const messenger = new MessengerServer('example', self);
messenger.bind('add', data => {
return data.x + data.y;
});
messenger.bind('close', () => {
messenger.close();
// Close this worker.
self.close();
});
constructor()const messenger = new MessengerClient();
connect(name, [endpoint[, options]])postMessage()The MessengerClient must connect to a MessengerServer via endpoint before communication can begin. To identify the MessengerServer to connect to, pass the unique name of the MessengerServer as the first argument. The endpoint is the object that actually executes the postMessage(). If omitted, it is assumed that self is set. The options are connection options and members of this object are targetOrigin and timeout (msec). If the timeout is omitted, this method will wait forever for a successful connection.
// To connect from the main window to a iframe.
const iframe = window.frames[0];
await messenger.connect('iframe', iframe, { targetOrigin: '*', timeout: 1000 })
.catch(e => console.log(e));
// To connect from the main window to a worker.
const worker = new Worker('/path/to/worker.js');
await messenger.connect('worker', worker, { timeout: 1000 })
.catch(e => console.log(e));
disconnect()Disconnects from the server.
messenger.disconnect();
send(topic[, data])Sends a message (some object) to a topic. This method does not wait for any reply. A MessengerServer can receive the message if it is bound to the same topic name in advance.
messenger.send('greeting', { hello: 'world' });
req(topic[, data[, timeout]])Sends a message (some object) to a topic. This method waits for some reply unlike send(). If timeout (msec) is omitted, this method waits forever for some reply.
const answer = await messenger.req('add', { x: 2, y: 3 })
console.log(answer);
await messenger.req('add', { x: 2, y: 3 }, 5000)
.catch(e => console.log(e)); // Catch timeout error.
subscribe(topic, listener)Subscribes to messages on a topic.
messenger.subscribe('news', data => console.log(data));
unsubscribe(topic[, listener])Unsubscribes to messages on a topic. If listener is omitted, all listeners for the topic are cleared.
const listener = data => console.log(data);
messenger.subscribe('news', listener);
messenger.unsubscribe('news', listener);
constructor(name, [endpoint])postMessage()const messenger = new MessengerServer('server', self);
The name is a unique name by which clients identify this MessengerServer. The endpoint is the object that actually executes the postMessage(). If omitted, it is assumed that self is set.
bind(topic, listener)Binds a listener to listen for messages on a topic. The topic names must be unique, no other listener than the first can bind on the same topic name. This method returns true or false as binding result.
messenger.bind('greeting', data => console.log(data));
messenger.bind('add', data => {
// Reply to client.
return data.x + data.y;
});
publish(topic, data)Publish a message (some object) to all subscribers on a topic. This method does not wait for reply from the subscribers, and also does not fail even there are no subscribers at all.
messenger.publish('notification', 'The process completed successfully.');
close()Closes all connections and shuts down the server.
messenger.close();
Chrome, Safari, Firefox, Edge
MIT
FAQs
Type-safe Request/Reply and Pub/Sub messaging library for browser applications
We found that @knowledgecode/messenger demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.