
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
CLI tool that waits for CPU load to drop below a threshold before executing commands
A CLI tool that waits for CPU load to drop below a threshold before executing commands. Perfect for running resource-intensive tasks only when your system has available capacity.
npx cpu-wait <command>
npm install -g cpu-wait
npm install cpu-wait
Wait for CPU usage to drop below 80% for 60 seconds, then run a command:
npx cpu-wait -- npm run build
Wait for CPU usage below 50%:
npx cpu-wait --threshold 50 -- make all
Wait for CPU to be low for 30 seconds:
npx cpu-wait --duration 30 -- ./heavy-process.sh
See detailed progress:
npx cpu-wait --verbose -- python train_model.py
Suppress all output except errors:
npx cpu-wait --quiet -- rsync -av source/ dest/
-t, --threshold <percent> - CPU usage threshold percentage (default: 80)-d, --duration <seconds> - Duration CPU must stay below threshold (default: 60)-i, --interval <seconds> - Check interval in seconds (default: 5)-v, --verbose - Show detailed progress messages-q, --quiet - Suppress all output except errors-h, --help - Display help-V, --version - Display versionnpx cpu-wait -- npm run build
npx cpu-wait --threshold 30 --duration 120 -- ./backup.sh
npx cpu-wait --threshold 50 -- ffmpeg -i input.mp4 -c:v libx264 output.mp4
npx cpu-wait -- bash -c "npm test && npm run build && npm run deploy"
Add to your package.json:
{
"scripts": {
"build:when-idle": "npx cpu-wait -- npm run build",
"test:when-idle": "npx cpu-wait --threshold 70 -- npm test"
}
}
You can also use cpu-wait as a library in your Node.js applications:
npm install cpu-wait
import { waitCpu } from 'cpu-wait';
// Wait with default settings (80% threshold, 60s duration)
await waitCpu();
console.log('CPU is now available!');
// Custom options
await waitCpu({
threshold: 50, // Wait for CPU < 50%
duration: 30, // For 30 seconds
interval: 2, // Check every 2 seconds
onProgress: (msg) => console.log(msg) // Progress callback
});
import { waitCpu, WaitCpuOptions } from 'cpu-wait';
async function runHeavyTask() {
const options: WaitCpuOptions = {
threshold: 70,
duration: 45,
interval: 3,
onProgress: (message) => {
console.log(`[CPU Monitor] ${message}`);
}
};
try {
console.log('Waiting for optimal CPU conditions...');
await waitCpu(options);
// Your heavy computation here
console.log('Starting heavy computation...');
await heavyComputation();
} catch (error) {
console.error('Failed to wait for CPU:', error);
}
}
interface WaitCpuOptions {
threshold?: number; // CPU threshold percentage (0-100)
duration?: number; // Duration in seconds
interval?: number; // Check interval in seconds
onProgress?: (message: string) => void; // Progress callback
}
MIT
snomiao
Issues and pull requests are welcome at GitHub
FAQs
CLI tool that waits for CPU load to drop below a threshold before executing commands
We found that cpu-wait demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.