
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
This is a simple search engine implementation that can index and search documents based on the input query. The search engine uses a scoring algorithm based on the BM25 ranking function.
To use this search engine, you need to have Node.js installed on your machine. You can clone this repository and run npm install to install any dependencies required.
npm i bm25-se
const { SearchEnginee, TokenizerEn } = require('bm25-se')
// create a new search engine instance
const searchEngine = new SearchEnginee({ tokenizer: new TokenizerEn() })
// add documents to the index
searchEngine.addDocument("this is an example document")
searchEngine.addDocument("this is another document")
searchEngine.addDocument("yet document")
// search for documents that contain the word "example"
const searchResults = searchEngine.search("example document")
console.log(searchResults) // should output a list of documents that match the query, ordered by relevance

You can try out the search engine in your browser by running the following command:
git clone https://github.com/Selenium39/bm25-se.git
cd bm25-se
npm install
npm run web
Then open http://localhost:3000 in your browser.

Creates a new instance of the search engine.
Resets the search engine, removing all indexed documents and terms.
Indexes a new document in the search engine.
Searches the indexed documents for the given query string and returns a list of matching documents.
A tokenizer object for tokenizing English text.
A tokenizer object for tokenizing Chinese text.
If you find any bugs or have any suggestions, feel free to open an issue or a pull request.
MIT License
FAQs
A lightweight search engine based on Okapi BM25 algorithm
The npm package bm25-se receives a total of 1 weekly downloads. As such, bm25-se popularity was classified as not popular.
We found that bm25-se demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.