
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@theholocron/node-utils
Advanced tools
This utility droid provides a set of single-purpose, functional utilities for writing NodeJS within the Galaxy.
This utility droid provides a set of single-purpose, functional utilities for writing NodeJS within the Galaxy.
$ npm install --save-dev @theholocron/node-utils
import utils from '@theholocron/node-utils';
utils.curl.getHTTPStatus('http://example.com'); // 200
utils.file.isFileOfType('/foo/bar/baz.json', 'json') // true
utils.git.remote() // 'https://github.com/the-holocron/astromech.git'
utils.log.error('foo') // [ERROR] foo
utils.semver.increment('1.0.0', 'major') // 2.0.0
utils.str.encode('foo') // Zm9v
The previous examples are only a sample of what utilities are available.
The best way to find out what's available is to check out the source code. More documentation and a possible site to explore are set to come.
This project uses a CHANGELOG and GitHub releases which contains a curated, chronologically ordered list of notable changes for each version of a project. Read more about changelogs.
We use SemVer for its versioning providing us an opt-in approach to releases. This means we add a version number according to the spec, as you see below. So rather than force developers to consume the latest and greatest, they can choose which version to consume and test any newer ones before upgrading. Please the read the spec as it goes into further detail.
Given a version number MAJOR.MINOR.PATCH, increment the:
Additional labels for pre-release and build metadata are available as extensions to the MAJOR.MINOR.PATCH format.
Have a bug or a feature request? Looking to contribute to advance the project? Read our contribution guide or maintenance guide first in order to understand how we do things around here. Or you could look at some of our other guides below:
Looking to talk to someone or need some help? Please read our support guidelines.
©2020 GNU General Public License v3. See LICENSE for specifics.
FAQs
This utility droid provides a set of single-purpose, functional utilities for writing NodeJS within the Galaxy.
We found that @theholocron/node-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.