
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
auto-launch-patched
Advanced tools
Launch node applications or executables at login (Mac, Windows, and Linux)
Auto-launch your app on login.
var AutoLaunch = require('auto-launch-patched');
var minecraftAutoLauncher = new AutoLaunch({
name: 'Minecraft',
path: '/Applications/Minecraft.app',
});
minecraftAutoLauncher.enable();
//minecraftAutoLauncher.disable();
minecraftAutoLauncher.isEnabled()
.then(function(isEnabled){
if(isEnabled){
return;
}
minecraftAutoLauncher.enable();
})
.catch(function(err){
// handle error
});
npm install --save auto-launch
new AutoLaunch(options)options - Object
options.name - String
The name of your app.
options.path - String (optional for NW.js and Electron apps)
The absolute path to your app.
For NW.js and Electron apps, you don't have to specify the path. We guess based on process.execPath.
options.isHidden - (Optional) Boolean
If true, we instruct the operating system to launch your app in hidden mode when launching at login. Defaults to false.
options.mac (Optional) object
For Mac-only options.
options.mac.useLaunchAgent (optional) Boolean.
By default, we use AppleScript to add a Login Item. If this is true, we use a Launch Agent to auto-launch your app. Defaults to false. For more information, see How does it work? (mac) below.
.enableSets your app to auto-launch at startup. Returns a Promise.
.disableDisables your app from auto-launching at startup. Returns a Promise.
.isEnabled()Returns a Promise which resolves to a Boolean; true if your app is set to launch on startup.
A Desktop Entry is created; i.e. a .desktop file is created in ~/.config/autostart/.
Note: if auto-launch is enabled and then your app is removed, this desktop entry file would be left behind on the user's machine.
We execute an AppleScript command to instruct System Events to add or remove a Login Item for your app. There are no files involved. To see your Login Items, you can go to System Preferences, Users & Groups, then Login Items. End users can add or disable items (including your app) here also, but most typical users aren't aware of it.

Note: This is not Mac App Store friendly; if you use it in your app, it will be rejected by the Mac App Store. We're only 99% sure on this as we haven't actually tried ourselves. See Make this Mac App Store compatible for more information.
This is a file-based method like Linux's Desktop Entry method. We add a .plist file in the user's Library/LaunchAgents directory to create a Launch Agent for your app.
Pros
Cons
If you find that the AppleScript method doesn't work for you and this method does, please let us know by creating an issue.
Note: This is not Mac App Store friendly; if you use it in your app, it will be rejected by the Mac App Store as this reaches outside of the app sandbox. See Make this Mac App Store compatible for more information.
We add a registry entry under \Software\Microsoft\Windows\CurrentVersion\Run.
Note: If the user was to remove your app, this would be left in the registry, but that's not such a big deal. You can probably configure your uninstaller to unset it.
If you're using Squirrel.Windows, i.e. what's underneath Electron's built-in autoUpdater API on Windows, we add a registry entry for your app's Update.exe instead of your actual application. This is due to how Squirrel.Windows works under the hood. What if we didn't? Well, if the user started / restarted their machine after updating your app, it would launch the old version by mistake.
We're always open to your help and feedback. See our CONTRIBUTING.md.
FAQs
Launch node applications or executables at login (Mac, Windows, and Linux)
The npm package auto-launch-patched receives a total of 20 weekly downloads. As such, auto-launch-patched popularity was classified as not popular.
We found that auto-launch-patched demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.