
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@withkoji/iap
Advanced tools
In-app purchase infrastructure for Koji templates.
The @withkoji/koji-iap package enables you to implement in-app purchases from your Koji templates. For example, require a purchase to unlock a premium asset or a game. This package provides frontend methods, for managing transactions with users, and backend methods, for validating purchases against receipts.
[DEPRECATED] This package is deprecated and is included only for backwards compatibility. For new templates, use @withkoji/core.
Install the package in the frontend and backend services of your Koji project.
npm install --save @withkoji/iap
NOTE: To support instant remixes of your template, you must also install the @withkoji/vcc package and implement the VccMiddleware on your backend server. This middleware maintains the process variables for instant remixes, ensuring that purchases are applied to the correct remix version.
Instantiate Iap on the frontend.
import Iap from '@withkoji/iap';
const iap = new Iap();
Instantiate Iap on the backend.
import Iap from '@withkoji/iap';
const iap = new Iap(
res.locals.KOJI_PROJECT_ID,
res.locals.KOJI_PROJECT_TOKEN,
);
See the contributions page on the developer site for info on how to make contributions to Koji repositories and developer documentation.
For any questions, reach out to the developer community or the @Koji Team on our Discord server.
FAQs
In-app purchase infrastructure for Koji templates
We found that @withkoji/iap demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.