
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@yipyap/blossom
Advanced tools
npm install @yipyap/blossom --save
This package contains a small handful of utilities for efficient probablistic checking for members in a set. This is achieved through the implementation of different Bloom filters. This package is a heavily refactored fork of node-bloem (which hasn't seen a commit in at least 11 years), that I intend to maintain for use in 🝰 dusk. Many thanks to the authors for their work.
A Bloom filter is a space-efficient probabilistic data structure used to test whether an element is a member of a set. It can quickly indicate if an item is definitely not in the set or possibly in the set, but it may produce false positives.
const { BloomFilter } = require('@yipyap/blossom').bloom;
const bloomFilter = new BloomFilter();
bloomFilter.add(Buffer.from('00acab00', 'hex'));
bloomFilter.add(Buffer.from('00131200', 'hex'));
console.log(bloomFilter.has(Buffer.from('00acab00', 'hex'))); // true
console.log(bloomFilter.has(Buffer.from('00131200', 'hex'))); // true
console.log(bloomFilter.has(Buffer.from('12345678', 'hex'))); // false
anti-copyright 2025, chihuahua.rodeo
licensed under the lesser gnu general public license 3.0
FAQs
scalable bloom filters
We found that @yipyap/blossom demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.