
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@lgv/pattern-hexagon
Advanced tools
ES6 svg hexagon pattern.
The following values can be set via environment or passed into the class.
| Name | Type | Description |
|---|---|---|
DIMENSION_UNIT | integer | width/height of single pattern swatch |
# install package
npm install @lgv/pattern-hexagon
import { HexagonPattern } from "@lgv/pattern-hexagon";
// initialize
const hp = new HexagonPattern();
// generate svg artboard
let artboard = document.createElementNS("http://www.w3.org/2000/svg", "svg");
artboard.setAttributeNS(null, "id", "artboard");
artboard.setAttributeNS(null, "width", 100);
artboard.setAttributeNS(null, "height", 100);
document.body.appendChild(artboard);
// generate pattern in svg
hp.generate(artboard, "my-pattern");
// style the hexagons
#my-pattern polygon {
fill: red;
stroke: blue;
}
// use pattern as fill on other elements
.some-class {
fill: url(#my-pattern);
}
// assume the svg element already exists (let artboard) from above code for using the module
// generate svg shape
let rectangle = document.createElementNS("http://www.w3.org/2000/svg", "rect");
rectangle.setAttributeNS(null, "x", 0);
rectangle.setAttributeNS(null, "y", 0);
rectangle.setAttributeNS(null, "width", 50);
rectangle.setAttributeNS(null, "height", 50);
rectangle.setAttributeNS(null, "fill", "url(#my-pattern)");
artboard.appendChild(rectangle);
FAQs
ES6 svg hexagon pattern.
The npm package @lgv/pattern-hexagon receives a total of 1 weekly downloads. As such, @lgv/pattern-hexagon popularity was classified as not popular.
We found that @lgv/pattern-hexagon demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.