
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@my-ideas/cftpl
Advanced tools
cftpl is a commandline utility to add a template engine (Mustache) to AWS CloudFormation
npm install -g @my-ideas/cftplcftpl <create|changeset> <template> [--stage <stage>] [--profile <profile>]Action create perform an upsert of the stack (create if doesn't exist, otherwise update). changeset create a ChangeSet with the given template
--profile ,profile>: the AWS profile to use to call CloudFormation (this is the only supported credential settings)--dry-run: if you specify this parameter, CloudFormation will not be called--stage <stage>: Add a variable stages: [{name: <stage>}] to the template metadata - this is usefull to create separate stack with the same template (see the examples in /test)The templating engine is Mustache, refer to Mustache' suser manual.
test/templates/simple-sns.yaml for a fully documented how-to write a templatetest/gtemplates/test-api-gateway/stack.tpl to see how to load external files in the templateFor large templates it is possible to upload the stack generated to S3 by adding the property Metadata.aws.template.__use_s3=bucket . See test/templates/simple-sns-s3-live.yaml
The following functions can be used inside a template:
{{funcTime}}: returns the value of new Date().getTime() - @see simple-sns-function.yaml{{#jsonize}}a.key{{/jsonize}}: Return the json representation of the given key - @see test-simple-functions.json{{#jsonizeEscapeQuotes}}a.key{{/jsonizeEscapeQuotes}},: serialize object a.key in JSON and escape all the quotes (which means, convert the object in a string that you can include in other strings. @see /test/templates/test-api-gateway/stack-functions.tpl)Notes:
BUG: If there are no changes, aws returns an error!
cftpl changeset test/templates/simple-sns.yaml --profile porketta --stage gamma | tail -n +4 | jq '.Changes | length'
FAQs
Add Mustache templating to AWS CLoudFormation
We found that @my-ideas/cftpl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.