
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@thi.ng/uuid
Advanced tools
[!NOTE] This is one of 214 standalone projects, maintained as part of the @thi.ng/umbrella monorepo and anti-framework.
🚀 Please help me to work full-time on these projects by sponsoring me on GitHub. Thank you! ❤️
Fast binary & string-based UUID v4 generation.
This package contains functionality which was previously part of and has been extracted from the @thi.ng/random package.
STABLE - used in production
Search or submit any issues for this package
yarn add @thi.ng/uuid
ESM import:
import * as uuid from "@thi.ng/uuid";
Browser ESM import:
<script type="module" src="https://esm.run/@thi.ng/uuid"></script>
For Node.js REPL:
const uuid = await import("@thi.ng/uuid");
Package sizes (brotli'd, pre-treeshake): ESM: 194 bytes
TODO
If this project contributes to an academic publication, please cite it as:
@misc{thing-uuid,
title = "@thi.ng/uuid",
author = "Karsten Schmidt",
note = "https://thi.ng/uuid",
year = 2020
}
© 2020 - 2026 Karsten Schmidt // Apache License 2.0
FAQs
Fast binary & string-based UUID v4 generation
We found that @thi.ng/uuid demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.