
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
WatchWorker
Advanced tools
Messaging APIs for communication with JavaScript Worker between watchOS and iOS.
This is an experimental plugin for asynchronous communication between a smartwatch and its encountered mobile using HTML5 SharedWorker APIs.
This plugin is ONLY available for iOS9.3, so please make sure that the deployment target is set to version 9.3 in your Xcode project (both project settings and target settings).
Please replace the contents in AppDelegate.m file within your Xcode project by the following lines.
#import "AppDelegate.h"
#import "MainViewController.h"
#import "{PRODUCT_NAME}-Swift.h"
@implementation AppDelegate
- (BOOL)application:(UIApplication*)application didFinishLaunchingWithOptions:(NSDictionary*)launchOptions
{
// Launch JavaScript execution context for WatchKit apps
[[WatchWorker sharedInstance] initializeWatchWorkerWithUrl:@"ApplicationScope.js"];
// Launch WatchConnectivity session to allow WatchConnectivity communication
[[WCMessageService sharedInstance] startServiceOnSuccess:nil onError:nil];
// We launch cordova WebView at last
self.viewController = [[MainViewController alloc] init];
return [super application:application didFinishLaunchingWithOptions:launchOptions];
}
@end
You must initialize watchworker first to evaluate your script file in the new JavaScript context.
/**
* Initialize a worker instance for smartwatch
* @parameter {string} url (currently is the filename of your script, without a suffix)
* @parameter {callback} onSuccess
* @parameter {callback} onError
*/
watchworker.initialize(url, onSuccess, onError);
// Please ensure that watchworker has been successfully initialized
watchworker.initialize(url, function() {
/**
* Post a message to smartwatch
* @parameter {string} message
* @parameter {callback} onSuccess
* @parameter {callback} onError
*/
watchworker.postMessage(message, onSuccess, onError);
}, onError);
// Please ensure that watchworker has been successfully initialized
watchworker.initialize(url, function() {
/**
* Add event listener to watchworker
* @parameter {string} type
* @parameter {callback} callback
*/
watchworker.addEventListener(type, callback);
// An example
watchworker.addEventListener("message", function(message) {
// TODO: message handler
});
/**
* Remove event listeners from watchworker
* @parameter {string} type
* @parameter {callback} onSuccess
* @parameter {callback} onError
*/
watchworker.removeEventListener(type, onSuccess, onError);
}, onError);
// On worker successfully initialized
var onSuccess = function () {
watchworker.addEventListener("message", function (message) {
// Receiving message
});
watchworker.addEventListener("error", function (error) {
// Receiving error
});
watchworker.postMessage("Message from web view!");
};
// On worker initialization error
var onError = function () {};
// Initialize with a context inside script file named ApplicationScope.js
watchworker.initialize("ApplicationScope.js", onSuccess, onError);
FAQs
Messaging APIs for communication with JavaScript Worker between watchOS and iOS.
We found that WatchWorker demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.