
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@redbuck/sorter
Advanced tools
npm i @redbuck/sorter或者
yarn add @redbuck/sorter
插件打包格式为UMD
因此既可以使用<script>标签引入,然后直接使用window.Sorter
也可以通过import或require的方式引入.
注意,插件使用了部分ES6API,如需兼容需要添加polyfill或者配置babel-runtime等.
<ul class="free" id="free">
<li class="item item-1">item-1</li>
<li class="item item-2">item-2</li>
<li class="item item-3">item-3</li>
<li class="item item-4">item-4</li>
<li class="item item-5">item-5</li>
<li class="item item-6">item-6</li>
<li class="item item-7">item-7</li>
<li class="item item-8">item-8</li>
</ul>
new Sorter(document.getElementById('free'))
mounted() {
this.dragger = new Sorter(this.$refs.list, {
change: false,
})
this.dragger.on('drag-over', pos => {
this.changeItem(pos);
setTimeout(() => {
this.dragger.freshThreshold();
}, 20)
})
}
知道了需要交换位置的元素,开发者可以自行操作数据,示例如下
changeItem({source, target}) {
let list = this.list;
let temp = list.splice(source, 1);
let start = list.splice(0, target);
// do something
this.list = [...start, ...temp, ...list];
},
git clone https://github.com/xty1992a/sorter.gitnpm i或yarnnpm run devlocalhost:8080FAQs
drag to sort element
The npm package @redbuck/sorter receives a total of 1 weekly downloads. As such, @redbuck/sorter popularity was classified as not popular.
We found that @redbuck/sorter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.