
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@mathquis/crfsuite
Advanced tools
A nodejs binding for crfsuite
This is a link to the CRFSuite library written by Naoaki Okazaki. CRF or Conditional Random Fields are a class of statistical modeling method often applied in pattern recognition and machine learning and used for structured prediction.
For most "standard" use cases (on Mac, Linux, or Windows on a x86 or x64 processor), node-crfsuite will install easy with:
npm install crfsuite
const crfsuite = require('crfsuite')
const tagger = new crfsuite.Tagger()
let is_opened = tagger.open('./path/to/crf.model')
console.log('File model is opened:', is_opened)
let tags = tagger.tag(input)
console.log('Tags: ', tags)
const path = require('path')
const crfsuite = require('crfsuite')
const trainer = new crfsuite.Trainer({
debug: true
})
let model_filename = path.resolve('./model.crfsuite')
let xseq = [['walk'], ['walk', 'shop'], ['clean', 'shop']]
let yseq = ['sunny', 'sunny', 'rainy']
// submit training data to the trainer
trainer.append(xseq, yseq)
trainer.train(model_filename)
// output: ./model.crfsuite
We use node-pre-gyp to compile and publish binaries of the library for most common use cases (Linux, Mac, Windows on standard processor platforms). If you have a special case, node-crfsuite will work, but it will compile the binary during the install. Compiling with nodejs is done via node-gyp which requires Python 2.x, so please ensure you have it installed and in your path for all operating systems. Python 3.x will not work.
# clone the project
git clone --recursive https://github.com/vunb/node-crfsuite.git
# go to working folder
cd node-crfsuite
# install dependencies and build the binary
npm install
For development:
# rebuild
npm run build
# run unit-test
npm test
nan.gitattributes, .editorconfignew keyword to create new Tagger and TrainerFrom crfsuite@0.9.6 the library uses N-API to use the binary in multiple version of Node.
Pull requests and stars are highly welcome.
For bugs and feature requests, please create an issue.
FAQs
NodeJS binding for CRFsuite
We found that @mathquis/crfsuite demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.