
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@living-papers/transforms
Advanced tools
Library of external transforms for Living Papers ASTs.
To be used by Living Papers, a transform implmentation must also be registered with Living Papers at compile time.
Transform information is provided in a package.json file, typically found in the root directory of a package.
Here is an example registration for a single transform (omitting other package.json entries):
{
"living-papers": {
"transforms": [
{
"name": "knits",
"file": "src/knitr/index.js"
}
]
}
}
A registration object supports two properties:
name: (required) The name of the custom transform. To apply the transform, this name should be included in a Living Papers article metadata block, under the transforms: key.file: (required) The source file containing the transform definition, relative to the package.json file. The transform is assumed to be the default export of the file.The compiler attempts to resolve transforms in the following increasing precedence order. Later entries can override earlier ones.
@living-papers/transforms).{inputDir}/package.json.If a component entry starts with ./, ../, or /, it is treated as a path relative to the input directory.
Otherwise, the component entry is treated as an npm package name.
External packages must also be included as dependencies in a projects package.json file.
FAQs
Built-in Living Papers AST transforms.
We found that @living-papers/transforms demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.