
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
一个快速简单的将github上的markdown博客部署到阿里云OSS的命令工具。
$ npm install blog-oss -g
$ blog-oss your-project-name
该命令将在当前文件夹初始化一个简单的仓库模版。请参照其中的README.md进行资源配置。
$ blog-oss deploy
该命令将自动将本地markdown的文章内容转成HTML并发布到OSS上。
$ blog-oss build
该命令会将本地Markdown文章转成HTML, 并保存到当前文件夹下(默认dist文件夹)。
最终在项目中的configs文件夹下的所有config都将被合并为一个config对象,例如:
// config.default.js中
module.exports = {
// 博客基础信息
name: '博客的名称',
slogen: '博客的口号',
favicon: '博客的favicon',
ICPCode: '备案号,没有则不显示备案号',
githubAddress: 'github地址,没有则不显示github地址',
github: { // github相关配置,用以创建评论。依赖gitalk: https://gitalk.github.io/
clientID: '',
clientSecret: '',
repo: '',
owner: '',
admin: [''],
},
oss: { // 阿里云相关配置信息
region: '',
bucketName: ''
}
};
// config.private.js中,该文件请不要提交到github
exports.oss = { // 阿里云OSS敏感信息
accessKeyId: '',
accessKeySecret: ''
}
exports.github = { // github敏感信息
personalAccessToken: ''
}
需要注意的是敏感信息(github token / oss accessKeySecret等)请保存在config.private.js内,该文件默认已被.gitignore包含。
该工具默认提供一款基础模版,如果需要自定义页面,则可以在配置文件中增加templates配置,配置方法如下:
// config.[name].js
exports.templates = {
article: 'templates/article.ejs',
index: 'templates/index.ejs'
};
需要注意的是,这里的模版文件路径为相对于博客项目的跟目录地址。并且目前仅支持ejs的模版.
index.ejs页面中,将会注入如下数据:interface props {
config: any;
list: Array<{
year: string;
subList: Array<{
title: string;
id: string;
year: string;
month: string;
day: string;
tags: string[];
menu: Array<{
title: string;
level: number;
id: string;
}>
filepath: string;
}>;
}>;
}
article.ejs页面中,将会注入如下数据:interface props {
title: string;
id: string;
year: string;
month: string;
day: string;
tags: string[];
menu: Array<{
title: string;
level: number;
id: string;
}>
filepath: string;
body: HtmlString,
config: any;
html: string;
}
article目录,所以如果需要访问文章,需要这样访问https://[yourOssBucketName].[yourOssRegion].aliyuncs.com/article/[yourArticleId].html具体体验如何,可以访问我的个人博客,它就是使用这个库进行发布的: 前端于我
我对于目前的功能感觉是完全够用的, 所以暂无支持新功能的想法。如果实际有其他人使用,并有痛点,我应该才会进行迭代。
FAQs
一个将github的markdown博客转换发布到阿里云OSS的工具库
The npm package blog-oss receives a total of 15 weekly downloads. As such, blog-oss popularity was classified as not popular.
We found that blog-oss demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.