
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@naverpay/nurl
Advanced tools
NURL is a powerful URL manipulation library that extends the standard URL class. It provides dynamic segment processing and flexible URL creation capabilities.
import {NURL} from 'nurl'
// Create URL from string
const url1 = new NURL('https://example.com/users/123?name=John')
// Create URL from existing URL object
const standardUrl = new URL('https://example.com')
const url2 = new NURL(standardUrl)
// Create URL from custom options object
const url3 = new NURL({
baseUrl: 'https://example.com',
pathname: '/users/:id',
query: {id: '123', name: 'John'},
})
// Create empty URL
const url4 = new NURL()
// Using the factory function
const url5 = NURL.create('https://example.com')
// The factory function also works with options object
const url6 = NURL.create({
baseUrl: 'https://example.com',
pathname: '/users/:id',
query: {id: '123', name: 'John'},
})
NURL processes dynamic segments in the pathname and replaces them with values from the query object. If a dynamic segment doesn't have a corresponding query value, it remains unchanged in the pathname without any encoding:
const url = new NURL({
baseUrl: 'https://api.example.com',
pathname: '/users/:a/posts/[b]/[c]',
query: {
a: '123',
b: '456',
format: 'json',
},
})
console.log(url.href)
// Output: https://api.example.com/users/123/posts/456/[c]?format=json
NURL automatically handles Internationalized Domain Names:
const url = new NURL('https://한글.도메인')
console.log(url.hostname) // xn--bj0bj06e.xn--hq1bm8jm9l
console.log(url.decodedHostname) // 한글.도메인 (in human-readable format)
NURL supports NURL.match(url, pattern) static method to match a URL path against a pattern with dynamic segments:
NURL.match('/v1/user/12345/info', '/v1/user/:userId/info')
// → { userId: '12345' }
NURL.match('/v1/friends/SENDMONEY/block/111/222', '/v1/friends/:serviceCode/block/:nidNo/:friendNidNo')
// → { serviceCode: 'SENDMONEY', nidNo: '111', friendNidNo: '222' }
NURL.match('/v1/user/12345', '/v1/admin/:id')
// → null (no match)
NURL provides NURL.mask(url, options) static method to mask sensitive path parameters in a URL for logging purposes:
// Default masking (**** with length 4)
NURL.mask('/v1/user/12345/info', {
patterns: ['/v1/user/:userId/info'],
sensitiveParams: ['userId'],
})
// → '/v1/user/****/info'
// Custom mask character and length
NURL.mask('/v1/user/12345/info', {
patterns: ['/v1/user/[userId]/info'],
sensitiveParams: ['userId'],
maskChar: 'X',
maskLength: 6,
})
// → '/v1/user/XXXXXX/info'
// Preserve original value length
NURL.mask('/v1/user/12345/info', {
patterns: ['/v1/user/:userId/info'],
sensitiveParams: ['userId'],
preserveLength: true,
})
// → '/v1/user/*****/info' (5 chars, same as '12345')
// Multiple sensitive params
NURL.mask('/v1/friends/SENDMONEY/block/12345/67890', {
patterns: ['/v1/friends/:serviceCode/block/[nidNo]/:friendNidNo'],
sensitiveParams: ['nidNo', 'friendNidNo'],
preserveLength: true,
})
// → '/v1/friends/SENDMONEY/block/*****/*****' (5 and 5 chars)
constructor(input?: string | URL | URLOptions)input: Can be one of the following:
string: Standard URL stringURL: Standard URL objectURLOptions: Custom options object that extends Partial<URL> and includes:
baseUrl?: string: Optional base URL stringquery?: Record<string, string>: Optional object for query parameterspathname, protocol, etc.):paramName or [paramName] format in the pathname.NURL inherits all properties from the standard URL class:
href, origin, protocol, username, password, host, hostname, port, pathname, search, searchParams, hashtoString(): Returns the URL as a stringtoJSON(): Returns the URL as a JSON representationNURL.create(input?: string | URL | URLOptions): NURL
new keyword.NURL.canParse(url: string): boolean
NURL.match(url: string, pattern: string): Record<string, string> | null
null if no match.NURL.mask(url: string, options: MaskOptions): string
MaskOptions:
patterns: string[]: Array of URL patterns with dynamic segments.sensitiveParams: string[]: Array of path parameters to be masked.maskChar?: string: Character used for masking (default: '*').maskLength?: number: Length of the mask (default: 4).preserveLength?: boolean: If true, mask length matches original value length (overrides maskLength).URLOptions, if a query value corresponding to a dynamic segment is missing, the dynamic segment remains unchanged in the pathname.:paramName or [paramName] format.FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.