
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
create-fastify
Advanced tools
Rapidly generate a Fastify project
There is no need to install this package directly.
npm init fastify [your_app_name]
The npm init command will find this package automatically and run it.
To integrate Fastify into an existing project:
npm init fastify --integrate
Note that this will overwrite files, so exercise caution.
Files and folders that will be overwritten by integrate mode:
The package.json file will not be overwritten but will be modified.
The plugins are loaded with @fastify/autoload with an empty default configuration.
If you feel you can help in any way, be it with examples, extra testing, or new features please open a pull request or open an issue.
The code follows the Standard code style.
The software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and non infringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the software or the use or other dealings in the software.
FAQs
Rapidly generate a Fastify project
The npm package create-fastify receives a total of 98 weekly downloads. As such, create-fastify popularity was classified as not popular.
We found that create-fastify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 19 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.