
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
JS TTL Cache Mechanism.
This is a UMD module that can be used as AMD module, native and NodeJS.
Run npm install cacherjs
A TTL cache mechanism with the following options at instance creation
Type: Number
Default value: 0
optional max items in cache - 0 is unlimited
Type: Cacher.MAX_STRATEGY
Default value: Cacher.MAX_STRATEGY.NO_ADD
optional strategy for max items (new items will not be added or closest ttl item should be removed)
Type: Number
Default value: 0
optional TTL for each cache item - 0 is unlimited
Type: Number
Default value: 1000
optional interval for eviction loop in milliseconds
Type: Function
Default value: Empty function
optional global handler for timeout of items in cache - return false if you want the items to not be deleted after ttl, or object { ttl: number, callback: function } to update the TTL or callback
Type: Function
Default value: Empty function
optional global handler for kick out (forced evict) of items in cache
Will get the value associated with the given key.
pop is a boolean flag indicating whether to also pop/remove the item from cache.
Will set value and associate it with the given key.
ttl will override the time to live for the item inside the cache.
callback will be called on item timeout - return false if you want the item to not be deleted after ttl, or object { ttl: number, callback: function } to update the TTL or callback
Will remove key from cache.
Will clean the cache completely
var Cacher = require("cacherjs").Cacher;
var cache = new Cacher({
ttl: 180000,
interval: 30000,
max: 5000,
maxStrategy: Cacher.MAX_STRATEGY.CLOSEST_TTL
});
ttlCache.set("key1", "someValue");
ttlCache.get("key1"); //"someValue"
MIT
FAQs
JS TTL Cache Mechanism
We found that cacherjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.