
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A Node.js module for data encryption and decryption using a singleton pattern to ensure consistent use of a single encryption key across an application.
npm install als-crypt
als-crypt provides a straightforward API for encrypting and decrypting data, supporting predefined cryptographic standards. During initialization, if a secret key does not exist, it is automatically generated and stored in a specified file, or by default, in a file named secret located within the package directory.
Customize the initialization by passing an options object, which may include settings for the algorithm, IV length, and the path to the secret key file. The key length is predefined based on the chosen algorithm to ensure security compliance.
const Crypt = require('als-crypt');
const options = {
algorithm: 'aes-256-cbc', // Default is 'aes-256-cbc'
ivLength: 16, // Default is 16, suitable for most AES modes
secretFilePath: '/path/to/your/secret' // Default is './secret' within the package directory
};
const crypt = new Crypt(options);
For default settings just use :
const Crypt = require('als-crypt');
const crypt = new Crypt();
If options are invalid, or the existing key does not fit the options, an error will be thrown. Handle these errors to prevent runtime exceptions:
try {
const crypt = new Crypt(badOptions);
} catch (error) {
console.error('Failed to initialize Crypt:', error.message);
}
const secretMessage = 'Hello world!';
const encryptedData = crypt.encrypt(secretMessage);
console.log(encryptedData); // Outputs encrypted data in hex format
const decryptedMessage = crypt.decrypt(encryptedData);
console.log(decryptedMessage); // Output: 'Hello world!'
The security of the encryption depends significantly on the secrecy and integrity of the key file. Ensure this file is stored in a secure location and access is strictly controlled. For environments requiring enhanced security measures, consider integrating more robust key management solutions or storing the key in a hardware security module (HSM).
FAQs
A Node.js module for data encryption and decryption using a singleton pattern to ensure consistent use of a single encryption key across an application.
The npm package als-crypt receives a total of 4 weekly downloads. As such, als-crypt popularity was classified as not popular.
We found that als-crypt demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.