
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
The minimalist lightening-fast javascript task-runner
Pre-requisite is node.js along with npm
$ npm install
The configuration file is required to be passed for generating the development or production builds. So modify the sample config.json as per your need.
Don not modify the structure of the sample config.json, but the tasks can be made in this format
action -> param1, param2, ..., paramN
In the aedifex.js file, we have Actions class, so each task have the action which maps with the static methods present in the class and the params are mapped with the arguments of those methods.
Since the tasks are listed under an array, so they can be repeated with same or different params. If there is no params required for method then just leave the portion as blank after arrow.
Finally, run the below commands when ready.
Prints the available switches and options.
$ node aedifex.js -h
Options:
--help -h Help
--version -v Version
--publish -p Publish build for production
--silent -s Hide console logs
--watch -w Watch & build for development
--config -c Set the config filepath
Prints the application name, version, description and license information.
$ node aedifex.js -v
AEDIFEX
Version 1.0.0
The minimalist javascript task runner
To produce build for distribution.
$ node aedifex.js -c ./config.json -p
Generating build for production
.
.
.
Finished at 8/2/2019, 3:00:17 PM
To re-build for development whenever any file changes under watching folder.
$ node aedifex.js -c ./config.json -w
Generating build for development
.
.
.
Finished at 8/2/2019, 3:00:17 PM
This switch can go with other switches but when used will not show any logs other than system errors.
$ node aedifex.js -c ./config.json -w -s
FAQs
Minimalist lightening-fast javascript task-runner
We found that aedifex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.