
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@tomaitken/ckeditor5-footnotes
Advanced tools
This package was created by the ckeditor5-package-generator package. It is essentially lifted from the ForumMagnum Footnote Plugin with only minor modifications. All intellectual credit should go to the developers of this plugin.
Install via NPM / yarn.
Then import code and CSS:
import '@tomaitken/ckeditor5-footnotes/index.css';
import { Footnotes } from '@tomaitken/ckeditor5-footnotes';
Then add this Footnotes import to the plugins list and the string 'footnote' to the toolbar buttons.
To read about the CKEditor 5 Framework, visit the CKEditor 5 Framework documentation.
NPM scripts are a convenient way to provide commands in a project. They are defined in the package.json file and shared with people contributing to the project. It ensures developers use the same command with the same options (flags).
All the scripts can be executed by running yarn run <script>. Pre and post commands with matching names will be run for those as well.
The following scripts are available in the package.
startStarts an HTTP server with the live-reload mechanism that allows previewing and testing of plugins available in the package.
When the server starts, the default browser will open the developer sample. This can be disabled by passing the --no-open option to that command.
You can also define the language that will translate the created editor by specifying the --language [LANG] option. It defaults to 'en'.
Examples:
# Starts the server and open the browser.
yarn run start
# Disable auto-opening the browser.
yarn run start --no-open
# Create the editor with the interface in German.
yarn run start --language=de
testThere are no tests for this plugin! Too lazy!
lintRuns ESLint, which analyzes the code (all *.ts files) to quickly find problems.
Examples:
# Execute eslint.
yarn run lint
stylelintSimilar to the lint task, stylelint analyzes the CSS code (*.css files in the theme/ directory) in the package.
Examples:
# Execute stylelint.
yarn run stylelint
build:distCreates npm and browser builds of your plugin. These builds can be added to the editor by following the Configuring CKEditor 5 features guide.
Examples:
# Builds the `npm` and browser files thats are ready to publish.
npm run build:dist
translations:collectCollects translation messages (arguments of the t() function) and context files, then validates whether the provided values do not interfere with the values specified in the @ckeditor/ckeditor5-core package.
The task may end with an error if one of the following conditions is met:
Unused context error – entries specified in the lang/contexts.json file are not used in source files. They should be removed.Context is duplicated for the id error – some of the entries are duplicated. Consider removing them from the lang/contexts.json file, or rewrite them.Context for the message id is missing error – entries specified in source files are not described in the lang/contexts.json file. They should be added.Examples:
yarn run translations:collect
translations:downloadDownload translations from the Transifex server. Depending on users' activity in the project, it creates translation files used for building the editor.
The task requires passing the URL to Transifex API. Usually, it matches the following format: https://www.transifex.com/api/2/project/[PROJECT_SLUG].
To avoid passing the --transifex option whenever you call the command, you can store it in package.json, next to the ckeditor5-package-tools translations:download command.
Examples:
yarn run translations:download --transifex [API URL]
translations:uploadUploads translation messages onto the Transifex server. It allows users to create translations into other languages using the Transifex platform.
The task requires passing the URL to the Transifex API. Usually, it matches the following format: https://www.transifex.com/api/2/project/[PROJECT_SLUG].
To avoid passing the --transifex option whenever you call the command, you can store it in package.json, next to the ckeditor5-package-tools translations:upload command.
Examples:
yarn run translations:upload --transifex [API URL]
ts:build and ts:clearThese scripts compile TypeScript and remove the compiled files. They are used in the aforementioned life cycle scripts, and there is no need to call them manually.
The @tomaitken/ckeditor5-footnotes package is available under IST license.
FAQs
A plugin for CKEditor 5 to allow footnotes.
We found that @tomaitken/ckeditor5-footnotes demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.