
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Arc is the base layer of the DAO stack. It consists a set of smart contracts deployed on the Ethereum blockchain that define the basic building blocks and standard components that can be used to implement any DAO.
DAOstack Arc is still in its alpha version. Arc is intended to provide secure, tested and community-audited code, but please use common sense when doing anything that deals with real money! We take no responsibility for your implementation decisions and any security problem you might experience.
truffle init.
npm install -g truffle
mkdir myproject && cd myproject
truffle init
@daostack/arc package: npm install @daostack/arc.
.sol Source code is found under node_modules/@daostack/arc/contracts.json Compiled contracts are found under node_modules/@daostack/arc/build/contractsimport '@daostack/arc/contracts/universalSchemes/UniversalScheme.sol';
contract MyContract is UniversalScheme {
...
}
You should be able to find all @daostack/arc already built contracts (.json) ready for deployment under node_modules/@daostack/arc/build/contracts/ folder.PRs are welcome but please first consult with the Contribution guide.
Join us on Telegram!
To contribute to Arc development start by cloning the repo and installing the dependencies:
git clone https://github.com/daostack/arc
cd arc
npm install
Available commands while developing:
npm run build - Compile all contracts to the build/ folder.npm run test - This will run ganache-cli, compile, migrate and run all tests.npm run lint - Check all JavaScript code for style & good practices.npm run solium - Check all Solidity code for style & good practices.npm run docs:<update|build|deploy|preview> - See this for details.Arc has a prebuilt Docker image that makes development environments consistent and cross-platform. To start developing inside this environment:
docker run --rm -it -v <path to repo>:/home/arc daostack/arc (*May require Admin/root permissions).git clone or git fetch depending on if <path to repo> is empty, and will install any dependencies.This is an open-source project (GPL license).
FAQs
A platform for building DAOs
The npm package arc_dx receives a total of 0 weekly downloads. As such, arc_dx popularity was classified as not popular.
We found that arc_dx demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.