
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@onehat/events
Advanced tools
@onehat/events Takes the node.js events package and adds the following functionality:
npm i @onehat/events
import EventEmitter from '@onehat/events';
class Widget extends EventEmitter {
constructor() {
super(...arguments);
// Typically, events are registered in constructor
this.registerEvents(['foo', 'bar']);
}
}
const widget = new Widget();
widget.on('foo', () => {
// do something
});
widget.emit('foo');
import EventEmitter from '@onehat/events';
const emitter = new EventEmitter();
// Register event
emitter.registerEvent('foo');
// Assign event handler
let emitted = false;
emitter.on('foo', () => {
emitted = true;
});
// Pause the events
emitter.pauseEvents();
// No events will be emitted now
// They are added to an internal queue
emitter.emit('foo');
expect(emitted).to.be.false;
// Resume the events
emitter.resumeEvents(true); // true to replay queued events in order. false to discard queued events
expect(emitted).to.be.true;
A relayed event will appear to be emitted from the relaying object, not from the origin object.
import EventEmitter from '@onehat/events';
const origin = new EventEmitter(),
relayer = new EventEmitter();
// Register the events on origin object
origin.registerEvents(['foo', 'bar']); // events can be registered directly on emitter object, rather than in a constructor
// Set up relaying from origin to relayer
relayer.relayEventsFrom(origin, ['foo', 'bar'], 'baz_'); // third argument allows optionally prepending event name with a prefix
// Assign event handler on the relayer object
let emitted = false,
arg1 = null,
arg2 = null;
relayer.on('baz_foo', (a, b) => {
emitted = true;
arg1 = a;
arg2 = b;
});
// Now emit the event on the origin
origin.emit('foo', true, false);
// verify everything worked
expect(emitted).to.be.true;
expect(arg1).to.be.true;
expect(arg2).to.be.false;
Relaying of events can become especially handy when there is a hierarchy of event emitters, and a child's events should "bubble up" to parents or grandparents. This is not so much a separate feature as it is a specific application of relaying of events. Each parent in the hierarchy needs to relayEventsFrom its children on initialization.
import EventEmitter from '@onehat/events';
// Set up our classes
class Child extends EventEmitter {
constructor() {
super(...arguments);
this.registerEvent('foo');
}
}
class Parent extends EventEmitter {
constructor(child) {
super(...arguments);
this.relayEventsFrom(child, child.getRegisteredEvents()); // relay ALL events from child
}
}
// Instantiate a parent and a child in hierarchical relationship
const child = new Child(),
parent = new Parent(child);
// Assign event handler for parent
let parentCount = 0;
parent.on('foo', () => {
parentCount++;
});
// Emit the event on the child
child.emit('foo'); // Event bubbles up to parent and is handled there!
expect(parentCount).to.be.eq(1);
// Now, let's push this a bit further, with another level of hierarchy.
const grandparent = new Parent(parent);
// Assign event handler for grandparent
let grandparentCount = 0;
grandparent.on('foo', () => {
grandparentCount++;
});
// Emit the event on the child again
child.emit('foo'); // Event bubbles up to *both parent and grandparent*
expect(parentCount).to.be.eq(2);
expect(grandparentCount).to.be.eq(1);
FAQs
Node.js 'events' module with extra enhancements
We found that @onehat/events demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.