
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@pyyupsk/fdu
Advanced tools
⚡ Ultra-fast, zero-dependency date-time library grounded in philosophical time perception — 4× faster than Day.js.
⚠️ Beta Release: This library is currently in beta (v0.0.0-beta.3). The API is stable but may change before v1.0.0. Production use is acceptable, but consider pinning to a specific version.
Temporal Correctness: fdu implements time based on how humans actually perceive it, grounded in research on time perception:
1.9 hours → 1 hour)Feb - Oct = 4 months)This reflects Ancient Greek philosophy (Chronos vs Kairos), phenomenology (Husserl), and temporal psychology (Stanford). Read full philosophy →
npm install @pyyupsk/fdu
import { fdu, registerLocale, locale } from "@pyyupsk/fdu";
import { es } from "@pyyupsk/fdu/locale/es";
const date = fdu("2025-09-30");
date.format("YYYY-MM-DD HH:mm:ss");
date.add(1, "day").format("[Tomorrow is] dddd");
registerLocale("es", es);
locale("es");
date.locale("es").format("LLLL");
Benchmarked with Vitest 4.0.15 and Bun 1.3.3 on 2025-12-05.
| Operation | @pyyupsk/fdu | Day.js | date-fns | Luxon | Speedup vs Day.js |
|---|---|---|---|---|---|
| Date Parsing | 2.88M ops/sec | 2.06M ops/sec | 134.1K ops/sec | 413.1K ops/sec | 1.40× faster |
| Date Formatting | 955.1K ops/sec | 548.7K ops/sec | 398.0K ops/sec | 626.1K ops/sec | 1.74× faster |
| Date Manipulation | 3.87M ops/sec | 965.2K ops/sec | 3.28M ops/sec | 449.1K ops/sec | 4.01× faster |
| Date Comparison | 20.17M ops/sec | 1.53M ops/sec | 4.92M ops/sec | 6.98M ops/sec | 13.18× faster |
| Complex Workflow | 549.8K ops/sec | 245.9K ops/sec | 415.5K ops/sec | 143.1K ops/sec | 2.24× faster |
| Batch Operations (100 dates) | 9.4K ops/sec | 5.3K ops/sec | 5.7K ops/sec | 2.8K ops/sec | 1.79× faster |
🧪 Summary:
fduis ~4× faster than Day.js on average, with exceptional performance in comparisons (13.18×), date manipulation (4.01×), and complex workflows (2.24×). See full benchmarks for details.
Full API and usage guides available at 👉 fdu.fasu.dev
By contributing to fdu, you agree that your contributions will be licensed under the MIT License.
FAQs
Ultra-fast, zero-dependency date-time library for JavaScript & TypeScript
We found that @pyyupsk/fdu demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.