
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@rayova/cdk-cloudfront-rules
Advanced tools
This CDK construct produces a CloudFront Function (not to be confused with Lambda @ Edge) that simplifies CloudFront-based URL rewriting and redirects.
// Create a CloudFrontRules construct
const cloudFrontRules = new CloudFrontRules(scope, 'CloudFrontRules', {
rules: [
// Rewrite URIs matching /rewrite-* to /* using a capture group. (Think
// Apache/.htaccess RewriteRule)
Rule.rewriteRule({
pattern: '^/rewrite-(.*)',
location: '/$1',
}),
// Redirect /redirect-* to https://www.example.com/*
Rule.rewriteRule({
pattern: '^/redirect-(.*)',
patternFlags: 'i', // case insensitive
location: 'https://www.example.com/$1',
redirectType: RedirectType.TEMPORARY,
}),
// Note: Rules are applied in the order they're provided. Rewrite rules
// are applied while there has not yet been a redirect or matching
// rewrite with the 'last' option.
//
// In this example, were you to visit a URI like
// /rewrite-redirect-foobar, the first rule will rewrite you to
// /redirect-foobar and then the second rule will match,
// redirecting you to https://www.example.com/foobar
],
});
// Create your CloudFront distribution.
const distribution = new cloudfront.Distribution(scope, 'Distribution', {
defaultBehavior: {
origin: new cloudfront_origins.HttpOrigin('www.example.com', {
protocolPolicy: cloudfront.OriginProtocolPolicy.HTTPS_ONLY,
}),
// Associate the produced function with VIEWER_REQUEST events.
functionAssociations: [{
eventType: cloudfront.FunctionEventType.VIEWER_REQUEST,
function: cloudFrontRules.function,
}],
},
});
FAQs
A rule-based CloudFront Function as a CDK Construct
We found that @rayova/cdk-cloudfront-rules demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.