
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@levellearning/game-cli-tools
Advanced tools
This package contains cli tools for the level learning content team.
You must be logged into npm as a user that has access to @levellearning org.
To log in to npm, do
npm login
Then install
npm i -g @levellearning/game-cli-tools
The cli tools provides the following commands:
Can be run by
mtgame-cli --flatten-directory
Optional Parameters: rootdir : string -- The directory to flatten. [default: CWD] outputdir : string -- The directory to dump the output into. [default: flatten-directory-output] cut : boolean -- Cut files from root into output dir instead of copying [default: false]
Copies every file in a directory recursively to a target directory. Renames every file to start with a prefix of the directories walked to avoid naming collisions. Directories are relative to the cwd or current working directory.
Can be run by
mtgame-cli --upload-decks
Optional Parameters: rootdir : string -- The directoy to start uploading decks from: [default: CWD] space : string -- Contentful space id. Will be prompted to provide if this argument not provided. token : string -- Contentful management token. Will be promited to provide if argument not provided.
Uploads decks to contentful from your local machine. Requires contentful space & token. Will be asked if not provided. If no rootdir argument is provided, it will use cwd as the rootdir.
From the rootdir, the folder structure should be like this:
GlossaryDecks
MyGlossasyDeckName
1.png
1cn.mp3
1en.mp3 (optional for now)
1es.mp3 (optional for now)
meta.json (will be auto generated. Do not touch the ids in here)
ParrotDecks
MyParrotDeckName
1.png
1cn.mp3
1en.mp3 (optional for now)
1es.mp3 (optional for now)
meta.json (will be auto generated. Do not touch the ids in here)
PairDecks
MyPairDeckName
1-1.png
1-1cn.mp3
1-1en.mp3 (optional for now)
1-1es.mp3 (optional for now)
1-2.png
1-2cn.mp3
1-2en.mp3 (optional for now)
1-2es.mp3 (optional for now)
meta.json (will be auto generated. Do not touch the ids in here)
Can be run by
mtgame-cli --help
Shows this help text
FAQs
mtgame game cli tools
We found that @levellearning/game-cli-tools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.