
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Bot18 is a high-frequency cryptocurrency trading bot developed by Zenbot creator carlos8f. More information available from the bot18.net website.
Keep in mind this is the BETA RELEASE. I will be constantly adding/changing stuff. Expect things to be broken, unfinished, and inconsistent. Live trading is discouraged unless you're just playing around with small amounts of currency, or really know what you're doing.
Soon I will develop a roadmap for Beta -> Stable progression, Beta testing rules/instructions, and community tools.
When the project stabilizes, I will conduct a poll for all Beta testers. If the majority feel it's ready for release, I will release the Stable version, end the Beta program, and raise the Unlock Code prices to $99.99 for Single-IP and $499.99 for Unlimited-IP. All Unlock Codes purchased during the Beta period will work with the Stable version, and forever after.
Please be patient and stay tuned!
Bot18 is "online" software, designed to be invoked without installing. The only pre-requisite is having Node.js >= 8.3.0 installed. The recommended way to launch is with the command:
$ npx bot18
If running Bot18 for the first time, you'll be asked to log into your ZalgoNet account (browser-based signup form is at bot18.net/register) or you can create a new account through the CLI.
All communications and local storage are safely encrypted using the latest:
To get the most out of Bot18, you'll need an 8-digit Unlock Code, purchasable for $49.99 (for a limited time!) at bot18.net/beta. You can pay by credit card or crypto-currency, and the code never expires and grants you automatic code updates for the entire Bot18 product lifecycle.
Or, you can try out Bot18 for free (enter "guest" as the ZalgoNet username or run with --channel trial), but you experience will be very sub-optimal. The "trial" engine distribution (also known as "cripple mode") is heavily DE-optimized (roughly 10x slower), does not support auto-trading strategies, and auto-quits after 15 minutes. If you like what you see, invest in an Unlock Code!
For full licensing details, see bot18.net/licensing.
npx bot18 command, to configure the bot. Make sure you chmod 0600 bot18.config.js to protect your configured API keys/passwords from exposure due to liberal filesystem permissions.npx bot18 --conf <path-to-bot18.config.js>, and/or define an account-wide conf at ~/.bot18/config.js.c.mongo.enabled=true in your conf file.The Beta engine build currently doesn't do anything but print something to stdio:

The current ALPHA version (now being ported to the Beta platform) is an early proof-of-concept, and supports:
Cheers and happy trading,
@carlos8f, May 31st 2018
Salty ID: 3t27msBTpN2Mn2LP68ZFLUUo3AN37aoGerUFPHdus9tFJg3hw7upmnY9c7nQ9fv1EFFF9nxiU9JzFSYPRAnx8Age
FAQs
A high-frequency cryptocurrency trading bot by Zenbot creator @carlos8f
The npm package bot18 receives a total of 281 weekly downloads. As such, bot18 popularity was classified as not popular.
We found that bot18 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.