
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@svelte-dev/auth-github
Advanced tools
The Github strategy is used to authenticate users against a github account. It extends the OAuth2Strategy.
For more details: https://github.com/willin/svelte-turbo
| Runtime | Has Support |
|---|---|
| Node.js | ✅ |
| Cloudflare | ✅ |
| Vercel | ✅ |
Follow the steps on the GitHub documentation to create a new application and get a client ID and secret.
import { GitHubStrategy } from '@svelte-dev/auth-github';
let gitHubStrategy = new GitHubStrategy(
{
clientID: 'YOUR_CLIENT_ID',
clientSecret: 'YOUR_CLIENT_SECRET',
callbackURL: 'https://example.com/auth/github/callback'
},
async ({ accessToken, extraParams, profile }) => {
// Get the user data from your DB or API using the tokens and profile
return User.findOrCreate({ email: profile.emails[0].value });
}
);
auth.use(gitHubStrategy);
<form action="/auth/github" method="get">
<button>Login with Github</button>
</form>
// routes/auth/github/+server
import { authenticator } from '~/auth.server';
import type { RequestHandler } from './$types';
export const POST: RequestHandler = async (event) => {
return authenticator.authenticate('github', event);
};
// routes/auth/github/callback/+server
import { authenticator } from '~/auth.server';
import type { PageServerLoad } from './$types';
export const load: PageServerLoad = async ({ event }) => {
return authenticator.authenticate('github', event, {
successRedirect: '/dashboard',
failureRedirect: '/login'
});
};
维护者 Owner: Willin Wang
如果您对本项目感兴趣,可以通过以下方式支持我:
Donation ways:
Apache-2.0
FAQs
Github Strategy for Svelte Auth
The npm package @svelte-dev/auth-github receives a total of 0 weekly downloads. As such, @svelte-dev/auth-github popularity was classified as not popular.
We found that @svelte-dev/auth-github demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.