
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@mhweiner/aws-tools
Advanced tools
A collection of tools for managing AWS infrastructure.
You must first authenticate via aws cli or export keys into shell.
./bin/create-stack {STACK_NAME} {TEMPLATE_FILE} {PARAMS_FILE}
Stack name is the name of the stack in CloudFormation. Template file is the path to the CloudFormation template. Params file is the path to the parameters file.
./bin/update-stack {STACK_NAME} {TEMPLATE_FILE} {PARAMS_FILE}
Stack name is the name of the stack in CloudFormation. Template file is the path to the CloudFormation template. Params file is the path to the parameters file. There must be changes to the template in order for the stack to update.
./bin/redeploy-stack {STACK_NAME} {TEMPLATE_FILE} {PARAMS_FILE}
Redeploys a CloudFormation stack with the given name and template file, using the existing stack's parameters. Useful for updating a stack with a new template without having to specify all the parameters again, or for re-deploying a stack that failed to create for some reason.
Commit messages are parsed via autorel to determine the version bump, channel/tag, and trigger a release. Commit messages must follow the following rules:
fix: fix a bug, feat: add new feature, feat!: add breaking change)build, ci, chore, docs, feat, fix, perf, refactor, revert, style, test.Here are some examples of commit messages and the resulting SemVer version bump:
fix: fix a bug -> 0.0.1feat: add new feature -> 0.1.0feat!: add breaking change -> 1.0.0By default, the following types do not trigger a version bump or release:
build, ci, chore, docs, refactor, style, testYou can find more examples in the Conventional Commits documentation.
Every commit made to main that triggers a release per above and passes CI is deployed to production via Github Actions. See the following:
FAQs
Tools for deploying services to AWS
We found that @mhweiner/aws-tools demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.