
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A lightweight AST (abstract syntax tree) interpreter built in javascript.
BASON is an acronym for Basic Abstract Syntax Object Notation.
While BASON does not include a parser, You can write programs directly in JSON.
Program in BASON is contstructed as a valid JSON object and contains a scriptScript is an array of expressions to be evaluated.Expression is a literal (string or number), or an object who's key is a keyword (Command, Function, or Variable) and value is its input parameter(s).Parameters are also an array of expressions. If there's only one parameter, there's no need for the containing array.[
{ "PRINT": "Hello World!" }
]
Each program is an array of expressions, and therefore wrapped in square brackets. This script only has one expression, an object whos key is the name of the command, in this case PRINT, and we supply it with a string literal which results in the text "Hello World!" printing to the console.
[
{ "LET": ["myvar", "World!"] },
{ "PRINT": { "ADD": [ "Hello ", {"myvar": null} ] } }
]
In this example we define a variable with the LET command which takes two parameters: the name of the variable and its value. We then use the ADD function to join the text "Hello " with the value of myvar to get "Hello World!" In BASON Script, Variables are referenced as objects with a null value.
[
{ "LET": ["i", 0] },
{
"REPEAT": 10,
"script": [
{ "SET": ["i", { "ADD": [ {"i": null}, 1 ] }] },
{ "PRINT": {"i": null} },
]
}
]
This program prints the numbers 1 to 10 to the console using the REPEAT command. Any command which executes a script such as loops takes a special object property called "script" who's value is a script array.
[
{
"FUNCTION": ["GREET", "name"],
"script": [
{ "PRINT": { "ADD": ["Hello ", {"name": null}] } }
]
},
{ "GREET": "Dan" }
]
Here we define a new function called GREET with an input parameter called name. Once it has been defined, we can use it the same as any other command. Presently, functions are not hoisted, so you must declare a function before it is used in a script.
Functions are locally scoped, so any variables or functions declared in them will not be accessible outside and will shadow anything of the same name in the outer scope.
BASON's syntax is obviously painful to write, so why would you want to use it? Well it has a couple of interesting use cases:
npm install bason --save
Import the package, define your program, and run it with BASON.RUN()
let BASON = require('bason')
let program = [
{ "LET": ["myvar", "World!"] },
{ "PRINT": { "ADD": [ "Hello ", {"myvar": null} ] } }
]
BASON.RUN(program);
npm run demo will run the example program located in demo/index.jsFAQs
A Javascript interpreter for a JSON scripting language
We found that bason demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.