
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@ndcode/min_js_cache
Advanced tools
An NDCODE project.
The min_js_cache package exports a single constructor
MinJSCache(diag)
which must be called with the new operator. The resulting cache object stores
the utf-8-encoded text of JavaScript files loaded from disk and minified.
See the build_cache, disk_build, and uglify-es packages for more
information. The MinJSCache object is essentially a wrapper object which
routes the request between these packages, to ensure that the minified
JavaScript text is either retrieved from RAM or minified from a source file as
required.
Suppose one has a MinJSCache instance named mjc. It behaves somewhat like
an ES6 Map object, except that it only has the mjc.get() function, because
new objects are added to the cache by attempting to get them.
The interface for the MinJSCache-provided instance function mjc.get() is:
await mjc.get(key) — retrieves the object stored under key, where
key is the on-disk pathname to a JavaScript file. A Buffer object is
returned, containing the utf-8-encoded text resulting from running
uglify-es on the source file. The pathname and the returned result are cached
for future reuse.
Before returning the cached copy, the existence and modification time of the
JavaScript file on disk is checked to make sure that the cache is up-to-date.
Otherwise, if the file doesn't exist an ENOENT exception is thrown, or if the
file exists it is loaded and minified and the cache updated for next time. The
minification is via disk, and skipped if an up-to-date disk result is present.
The diag argument to the constructor is a bool, which if true causes
messages to be printed via console.log() for all activities except for the
common case of retrieval when the object is already up-to-date. A diag value
of undefined is treated as false, thus it can be omitted in the usual case.
The uglify-es package is called with standard NDCODE options. This is part of
the reason to have min_js_cache, so as to provide a consistent interface to
minifiers for JavaScript, CSS, SVG and so on. However, if some control of the
underlying minifier is needed in future, we could add an options object to
pass through, in which we'd inject our NDCODE options where not overridden.
It is intended that we will shortly add a timer function (or possibly just a
function that the user should call periodically) to flush built templates from
the cache after a stale time. There is otherwise no way to delete an object
from the cache, except by first deleting it on disk, then trying to get it.
The development version can be cloned, downloaded, or browsed with gitweb at:
https://git.ndcode.org/public/min_js_cache.git
All of our NPM packages are MIT licensed, please see LICENSE in the repository.
The caching system is under active development (and is part of a larger project that is also under development) and thus the API is tentative. Please go ahead and incorporate the system into your project, or try out our example webserver built on the system, subject to the caution that the API could change. Please send us your experience and feedback, and let us know of improvements you make.
Contact: Nick Downing nick@ndcode.org
FAQs
JS minimizer, caching front-end with live recompilation
We found that @ndcode/min_js_cache demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.