
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
chenkl-utils
Advanced tools
前端 js 工具库: 封装常用的工具函数,如日期格式化、浏览器判断等,提高开发效率 该项目也可以当做一个学习 typescript 和 rollup 的途径=
dist 目录下的 utils.min.js 使用,支持 UMD 通用模块规范<script src="utils.min.js"></script>
<script>
var result = utils.isNumber(1)
</script>
npm i chenkl-utils
var utils = require("chenkl-utils")
var result = utils.isNumber(1)
import utils from "chenkl-utils"
var result = utils.isNumber(1)
import isNumber from "chenkl-utils/lib/isNumber"
var result = isNumber(1)
typedoc是一个根据 typescript 文件中注释信息,生成 typescript 应用程序或库、模块的 API 文档 的工具。你可以使用他记录如:命名空间,类,方法,方法参数等。从而使开发者很容易了解整个工具库其中的属性和方法,并且快速知道如何使用,从而提高开发效率,降低维护成本。
npm run doc
FAQs
the best utils for me
We found that chenkl-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.