
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Bilbo is a simple dependency injection library for JavaScript. It's intended audience is for node-js applications, but it can also be used for client-side applications.
He uses bags to store and distribute dependencies along your code. Bags are identifies by it's name within bilbo.
var bilbo = require("bilbo");
var bag = bilbo.bag("bag's name");
If there is no bag with a given name, bilbo.bag() will create one.
Fetching things from a bag is done by the bag.grab() method. Each thing is identified by it's name within the bag.
var thing = bag.grab("thing's name");
Bags can store things in many ways:
Just stores something within the bag itself. No modification whatsoever is taken upon the stored data.
var myStuff = {};
// stores myStuff under "stuff's name"
bag.stuff("stuff's name", myStuff);
// grabs back myStuff using "stuff's name"
var myStuffBack = bag.grab("stuff's name");
myStuff === myStuffBack; // true
Stores a prototype object. This object will be used as prototype for a newly created object each time bag.grab() is called.
var myPrototype = { a: {} };
// stores myPrototype under "prototype's name"
bag.prototype("prototype's name", myPrototype);
// grabs a new object having myPrototype as prototype using "prototype's name"
var myObject = bag.grab("prototype's name");
myObject.a === myPrototype.a; // true
myObject.hasOwnProperty("a"); // false
Stores a factory function. This function will be used to create new things each time bag.grab() is called.
var myFactory = function() { return {}; };
// stores myFactory under "factory's name"
bag.factory("factory's name", myFactory);
// grabs oneThing created by the myFactory function
var oneThing = bag.grab("factory's name");
// grabs anotherThing created by the myFactory function
var anotherThing = bag.grab("factory's name");
oneThing === anotherThing; // false
Stores a lazy function. This function will be used only once to create a new thing when bag.grab() is called. Subsequent calls will return the same thing created the first time it was called.
var myLazy = function() { return {}; };
// stores myLazy under "lazy's name"
bag.lazy("lazy's name", myLazy);
// grabs a thing created by the myLazy function
var thing = bag.grab("lazy's name");
// grabs the sameThing created by the myLazy function previously
var sameThing = bag.grab("lazy's name");
thing === sameThing; // true
Stores a type constructor function. This function will be used as a constructor to create new type instances each time bag.grab() is called.
var MyConstructor = function() {};
// stores MyConstructor under "type's name"
bag.type("type's name", MyConstructor);
// grabs anInstance created by the MyConstructor function
var anInstance = bag.grab("type's name");
// grabs anotherInstance created by the MyConstructor function
var anotherInstance = bag.grab("type's name");
anInstance === anotherInstance; // false
anInstance instanceof MyConstructor; // true
anotherInstance instanceof MyConstructor; // true
Stores a type constructor function as a singleton. This function will be used as a singleton constructor to create a singleton instance once bag.grab() is called. Subsequent calls yields the same singleton instance.
var MySingletonConstructor = function() {};
// stores MySingletonConstructor under "singleton's name"
bag.singleton("singleton's name", MySingletonConstructor);
// grabs aSingleton created by the MySingletonConstructor function
var aSingleton = bag.grab("singleton's name");
// grabs sameSingleton created by the MySingletonConstructor function previously
var sameSingleton = bag.grab("singleton's name");
aSingleton === sameSingleton; // true
aSingleton instanceof MySingletonConstructor; // true
FAQs
Dependency Injection for JavaScript
We found that bilbo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.