
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@owngames/notion
Advanced tools
@owngames/notion 🚧️ 🚧️ 🚧️Wrapper stuff for ygorluizgerald.com.
📝️ Please Note:
any types (currently)This is really a custom thing, so not sure how useful this would be for anyone else.
This will not be ready for production/OSS use until 3.0.0 at the earliest. I would imagine all attempts at documentation will wildy fluctuate.
Notion + Next.js + swr
The concept is kind of mapping databases from Notion to routeTypes in Next being kept in-sync post build via swr.
You will need a few values set up in Notion and identified in a configuration file within your repo provided to this package. (And by few, this is an understatement. [Good news! You can create all the values dynamically, howver, that is outside of this package currently.])
This API extends @notionhq/client so you will extend this one instead.
import { Client } from '@owngames/notion'
import { notionConfig as config } from '~config/websites'
const notion = new Client({ auth: process.env.NOTION_API_KEY, config })
You need to pass config which informs the package of all the wonderful Notion stuff you have. Will fill this out as I go (I hope haha).
(alias) const notionConfig: {
DATABASES: Databases;
NOTION: DatabaseInfo;
PAGES__HOMEPAGE: string;
PAGES: string[];
ROUTE_META: any[];
ROUTE_TYPES_BY_DATA_TYPES: Object;
ROUTE_TYPES: any[];
}
DATABASES: 🔑️ is uppercase (usually gripped by routeType)NOTION: 🔑️ is uppercase; 🛠️ configuration for DB
active: booleandatabase_id: stringdataTypes: DataTypes[]hasChild: string | nullinfoType: any | nullisChild: string | nullisChildInfoType: any | nullname: stringpage_id__seo: stringrouteMeta: booleanrouteType: stringslug: stringttl: numberPAGES__HOMEPAGE: 🤕️ what Pages => slug is the homepage?PAGES: 🤕️ Only active routeTypes brought backROUTE_META: 🤕️ up front share if we expect the route to have a meta (BLOG|EVENTS|PODCASTS)ROUTE_TYPES_BY_DATA_TYPES: For each DATA_TYPE determine which routeType are associatedROUTE_TYPES: 🤕️ Only active routeTypes brought backWill add an ./examples/next/... to show this with a public facing Notion at some point.
Custom setup to get pathVariables from next:
[...catchAll]:
export const getStaticProps = async ({ preview = false, ...props }) => {
const { catchAll } = props.params
// @todo(next)
const clear = false
const pathVariables = notion.custom.getPathVariables({ catchAll })
/**
* @cache
* - pages = TRUE
* - pages/api = FALSE
*/
const cache = true
const data = await getDataReturn({
data: await getCatchAll({
cache,
catchAll,
clear,
pathVariables,
preview,
}),
pathVariables,
})
return {
props: { preview, ...data, ...pathVariables, ...props },
revalidate,
}
}
export const getStaticPaths = () => {
return getStaticPathsCatchAll()
}
getCatchAll.ts:
cachedataType from getPathVariables calls notion.dataTypesdataplaiceholder to generate imagescache if it shouldgetStaticPathsCatchAll.ts:
PAGES__HOMEPAGE => index.tsPAGES => Until we can get a proper query to dynamically generatenext based off of NOTION[#__database__#].databaseTypes:
LISTINGLISTING_BY_DATESLUGSLUG_BY_ROUTEblog => ./blog/yyyy/mm/dd/blog-titleevents => ./events/yyyy/mm/dd/events-titleepisodes => ./podcasts/#__podcast-title__#/#__episode-title#Currently set to json files within next build. This (currently) causes it to be generated every build.
For larger datasets this should move to a Key/Value Store that takes into account lastEdited from Notion for anything since the last build. (Or someting like that.)
Next and Notion are awesome.
Before @notionhq/client this was really hacky (cough actually more than this, haha). And now that the API is public, figured I would move this out to keep myself honest and find ways to continually improve it since I had this as a private repo with no documentation (hence a lot of any types and a lack of a formal or even informal README).
FAQs
Notion: Custom Client for ygorluizgerald.com
We found that @owngames/notion demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.