
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@membrane/wasm-stack-trace
Advanced tools
Enhance `Error.stack` with wasm demangled symbols and file/line/column information. Uses DWARF data to symbolicate stack traces.
Wasm stack trace symbolication using embedded DWARF data. Works in the browser and node.js

Place one of these script tags before any script that loads webassembly and you should be good to
go. The scripts are ~138kb gziped, including the embedded wasm that we use for DWARF processing.
Option 1. Link to the current version and use integrity for extra peace of mind
<script src="https://cdn.jsdelivr.net/npm/@membrane/wasm-stack-trace@0.1.4/dist/index.js" integrity="sha256-mSIOJQa0JP9kJG7E0U5Pi3dc5zp3wnf4rHjwIGHFz/A=" crossorigin="anonymous"></script>
Option 2. Link to the latest version so it's always up-to-date
<script src="https://cdn.jsdelivr.net/npm/@membrane/wasm-stack-trace@latest"></script>
Option 3. Download the latest version and self host it.
Option 4. Build it yourself (npm run build)
For symbolication to be possible, the right debug data needs to be included in your .wasm, so make
sure you configure cargo correctly. The default configuration for debug builds can easily turn a
10MB .wasm into 100MB or more which is often annoying. Instead, consider adding this to your
Cargo.toml to trim it down while keeping the data needed for proper stack traces:
[profile.dev]
debug = "line-tables-only" # Recommended. Everything you need for proper stack traces.
debug = 1 # Not sure if this helps with stack traces. but it "Generates more
# detailed module level info"
debug = 2 # Default for "dev". Includes info on variables and types that are
# only used by debuggers. Greatly increases binary size so it's not
# recommended unless you plan to attach a debugger.
I also recommend using opt-level=1 in debug builds, but that depends on your specific use case. The higher the opt-level, the more your call will get inlined potentially reducing the fidelity of the stack traces.
Error.stack property is accessed
containing at least one wasm frame.install to
run synchronously so that you can be sure that stacks will be symbolicated immedaitely.FAQs
Enhance `Error.stack` with wasm demangled symbols and file/line/column information. Uses DWARF data to symbolicate stack traces.
We found that @membrane/wasm-stack-trace demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.