
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
chrome-runtime-connect
Advanced tools
Disclaimer: This is incomplete for now, still a work in progress but nonetheless usable for simple cases.
This package allows to test the communication between a background page and a
content script.
It emulates the chomer.runtime.Port interface
(doc.
yarn add chrome-runtime-connect
// a. Call this to extend the global scope with `chrome.runtime`
require('chrome-runtime-connect/register');
// b. Or call this to have a `runtime` object
const chromeRuntime = require('chrome-runtime-connect')();
Since the runtime API is exposed globally (using method a), in your tests your content scripts will be able to use the runtime API as-is.
Note: This is most useful when used it combination of a browser implementation such as jsdom.
FAQs
chrome-runtime-connect ======================
The npm package chrome-runtime-connect receives a total of 3 weekly downloads. As such, chrome-runtime-connect popularity was classified as not popular.
We found that chrome-runtime-connect demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.