
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@reduct/registry
Advanced tools
Defines a set of objects and exposes methods to operate on that
With npm, use the familiar syntax e.g.:
npm install @reduct/registry --save
once the registry package is installed, just require it in your application file.
const registry = require('@reduct/registry');
This package also supports AMD/RequireJS. Aren't using AMD or CommonJS? Just grab a release, include the Dist/Registry.min.js and access the registry via the following global:
const registry = window.reduct.registry;
Type: Function
Argument item: *
Argument alias: String
Returns: Registry The registry itself (for enabling method chaining)
Registers a single item in the registry. If no alias is provided, it tries to guess the name of the item, which basically means, that if you're passing a function, it'll use the function name as the alias. Since es2015 classes are just sugar for functions acting as constructors, this applies for classes too.
Type: Function
Argument itemMap: Object
Returns: Registry The registry itself (for enabling method chaining)
Registers multiple items at once. The object keys of itemMap will act as aliases and the values as items.
Type: Function
Argument alias: String
Returns: *
Retrieves the item with the given alias from the registry. An error will be thrown, if the item doesn't exist.
Type: Function
Argument aliases: Array
Returns: Array
Retrieves multiple items with the given aliases from the registry. An error will be thrown, if any of these items doesn't exist.
Type: Function
Argument alias: String
Returns: Promise
Returns a Promise that will resolve as soon as an item gets registered under the given alias.
Type: Function
Argument aliases: Array
Returns: Promise
Returns a Promise that will resolve as soon as all items identified by an array of aliases are getting registered.
Type: Function
Argument alias: String
Argument timeout: Number
Returns: Promise
Returns a Promise that will resolve as soon as an item gets registered under the given alias. The Promise will be rejected after timeout milliseconds, if until then no item got registered.
Type: Function
Argument aliases: Array
Argument timeout: Number
Returns: Promise
Returns a Promise that will resolve as soon as all items identified by an array of aliases are getting registered. The Promise will be rejected after timeout milliseconds, if until then no item got registered.
Type: Function
Argument: namespace: String
Returns: Object
Returns a namespaced version of the registry API. All items will be registered and retrieved with namespace automatically prefixed to their identifiers. A trailing slash is automatically added to namespace.
Type: Function
Argument: namespace: String
Argument: callback: Function
Returns: Object
Calls callback with a namespaced version of the registry API as its first argument. All items will be registered and retrieved with namespace automatically prefixed to their identifiers. A trailing slash is automatically added to namespace.
In lieu of a formal styleguide, take care to maintain the existing coding style.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
Defines a set of objects and exposes methods to operate on that
We found that @reduct/registry demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.