
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Unichains, batteries included.
BitSpace is a lightweight server that provides remote access to Unichains and a BitSwarm instance. It exposes a simple RPC interface that can be accessed with the Bitspace client for Node.js.
The RPC API's designed to be minimal, maintaining parity with Unichain and the @web4/chainstore-networker but with few extras.
Features include:
RemoteChainstore interface for creating namespaced Chainstore instances.RemoteNetworker interface for managing BitSwarm DHT connections. Supports stream-level extensions.RemoteUnichain interface that feels exactly like normal ol' Unichain, with few exceptions. Extensions included.With Bitspace, most of the BitDrive daemon's functionality has been moved into "userland" -- instead of providing remote access to BitDrives, the regular bitdrives module can be used with remote Unichains.
If you're currently using the BitDrive daemon with FUSE and/or the daemon CLI, take a look at the upgrade instructions in bitdrive-cli, which is our new BitDrive companion service for handling FUSE/CLI alongside BitSpace.
Note: The first time you run Bitspace, it will detect your old BitDrive daemon installation and do an automatic migration. You can postpone the migration by starting the server with the --no-migrate flag (bitspace --no-migrate).
npm i bitspace -g
When installed globally, you can use the bitspace CLI tool to start the server:
❯ bitspace --no-migrate // Starts the server without performing the BitDrive daemon migration
The bitspace command supports the following flags:
--bootstrap // BitSwarm bootstrapping options (see BitSwarm docs).
--host // Host to bind to.
--port // Port to bind to (if specified, will use TCP).
--memory-only // Run in memory-only mode.
--no-announce // Never announce topics on the DHT.
--no-migrate // Do not attempt to migrate the BitDrive daemon's storage to Bitspace.
--repl // Start the server with a debugging REPL.
By default, Bitspace binds to a UNIX domain socket (or named pipe on Windows) at ~/.bitspace/bitspace.sock.
Once the server's started, you can use the client to create and manage remote Unichains. If you'd like the use the BitDrive CLI, check out the @web4/bitdrive docs.
To work with Bitspace, you'll probably want to start with the Node.js client library. The README over there provides detailed API info.
Bitspace includes a "simulator" that can be used to create one-off Bitspace instances, which can be used for testing.
const simulator = require('bitspace/simulator')
// client is a BitspaceClient, server is a BitspaceServer
const { client, server, cleanup } = await simulator()
MIT
FAQs
Unichains, batteries included.
We found that bitspace demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.