
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@naverpay/publint
Advanced tools
@naverpay/publint is a specialized tool for verifying and linting npm package structure and `package.json` files, tailored specifically for NaverPay frontend developers. It ensures that packages meet both general npm standards and NaverPay's internal best
@naverpay/publint is a specialized tool for verifying and linting npm package structure and package.json files, tailored specifically for NaverPay frontend developers. It ensures that packages meet both general npm standards and NaverPay's internal best practices for modern JavaScript and TypeScript projects.
package.jsonexports fieldThis tool incorporates NaverPay's internal frontend development guidelines, ensuring that all packages published by the team maintain consistent quality and structure. Some of the NaverPay-specific checks include:
package.jsonBy using @naverpay/publint, developers can ensure their packages are compliant with team standards before publication.
You can install @naverpay/publint globally:
npm install -g @naverpay/publint
Or use it directly with npx without installing:
npx @naverpay/publint
If installed globally, you can use publint directly in your project directory:
publint
Or specify a custom directory:
publint ./my-project
Using npx (without global installation):
npx @naverpay/publint
Or with a custom directory:
npx @naverpay/publint ./my-project
package.jsonexports fieldpackage.json, including NaverPay-specific fieldsexports fieldThe tool will provide detailed feedback on the verification process, including any errors or warnings encountered during the checks. It will specifically highlight any deviations from NaverPay's internal standards.
Contributions are welcome from NaverPay team members! Please ensure you're familiar with our internal development guidelines before submitting a Pull Request.
This project was inspired by publint, created by Bjorn Lu. We appreciate their work in improving the npm package ecosystem. @naverpay/publint builds upon this foundation to meet the specific needs of the NaverPay frontend development team.
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.