
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
A minimal cache that actually just is a Set.
npm install --save cache-set
var CacheSet = require('cache-set')
var cache = new CacheSet()
cache.add(27, 419) // time-to-live, value
console.log(cache, cache.size)
setTimeout(function () {
console.log(cache, cache.size) // will be empty
}, 28)
var cache = new CacheSet([ttl, iterable][, willDelete(value, doDelete)])Create a new CacheSet instance. If iterable is provided all passed items get added to the set during instantiation, and deleted after ttl. If willDelete is a function it will be called as a cleanup hook before items are deleted from the set but after ttl has exceeded. Make sure to call the doDelete callback at the end of the willDelete hook to actually perform the deletion.
cache.add(ttl, ...itemsAndOptionalwillDeleteHook)Provide ttl, time to live in ms, and a variable number of items that will get deleted from the set at the end of their lifetime. If the last argument is a function it will be called as a cleanup hook before items are deleted from the set but after ttl has exceeded. Make sure to call the doDelete callback at the end of the willDelete hook to actually perform the deletion.
cache.find(predicate)Find a value in the set. Equivalent to Array.prototype.find.
cache.some(predicate)Check if any predicate(value) is truthy. Equivalent to Array.prototype.some.
cache.every(predicate)Check if all predicate(value) are truthy. Equivalent to Array.prototype.every.
FAQs
a Set cache, self-clearing, with willDelete hook
We found that cache-set demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.