
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
This is where I put my JavaScript code to generate RSS feeds from my apps, running in the browser and in Node.
I put together a simple test app that includes an example of the data you would send to daverss, as a pair of JavaScript objects, to build a feed.
It comes from my Radio3 linkblog, which is a real feed, still updated daily in January 2020.
If there's a markdowntext value for an item, generate a source:markdown element in the item in the feed.
Change the value of rssCloudDefaults.path to /ping, which according to Andrew Shell is the actual path rpc.rsscloud.io responds to. Andrew runs that server.
In package.json we now require dateformat 4.5.1 because they updated the package to not work with older versions of Node.
I wanted to get the Cuomo podcast feed to validate through iTunes, so I added the needed features.
Support for the <channel> level <image> element.
Two elements of the itunes namespace: category and explicit.
Added a test app that illustrates how to use the package in a Node app.
Bring in support for Facebook Instant Articles feeds.
Per Dan MacTough's suggestion, in the JSON version, the length attribute on enclosure should be a number. If it coerces to a number, great, if there's an error, leave out the length property.
Change name of rss.getRssEnclosureInfo to rss.getEnclosureInfo.
Major code review, bring it up to date with my latest software. Also includes buildJsonFeed which generates a 1-1 equivalent of the RSS feed, but using JSON instead of XML. I plan to support this format in Scripting News.
FAQs
This is where I put my code to generate RSS feeds from server apps.
The npm package daverss receives a total of 212 weekly downloads. As such, daverss popularity was classified as not popular.
We found that daverss demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.