
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
dale-chall
Advanced tools
List of easy American-English words: new Dale–Chall (1995).
This package exposes a list of pretty useless words, which are typically used to fill empty space.
Use this when you want to do readability things with natural language.
Use dale-chall-formula for the formula.
This package is ESM only. In Node.js (version 14.14+, 16.0+), install with npm:
npm install dale-chall
In Deno with esm.sh:
import {daleChall} from 'https://esm.sh/dale-chall@2'
In browsers with esm.sh:
<script type="module">
import {daleChall} from 'https://esm.sh/dale-chall@2?bundle'
</script>
import {daleChall} from 'dale-chall'
daleChall.length // => 2942
console.log(daleChall.slice(0, 10))
Yields:
[ 'a',
'able',
'aboard',
'about',
'above',
'absent',
'accept',
'accident',
'account',
'ache' ]
This package exports the identifier daleChall.
There is no default export.
daleChallList of strings (Array<string>).
See countwordsworth.com.
This package is fully typed with TypeScript. It exports no additional types.
This package is at least compatible with all maintained versions of Node.js. As of now, that is Node.js 14.14+ and 16.0+. It also works in Deno and modern browsers.
dale-chall-formula
— Formula to detect the grade level of textspache
— list of familiar American-English words (1974)Yes please! See How to Contribute to Open Source.
This package is safe.
MIT © Titus Wormer
FAQs
List of familiar American-English words: The New Dale-Chall (1995)
We found that dale-chall demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.