
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
dev-notify-bridge
Advanced tools
Lightweight local HTTP bridge that delivers native desktop notifications for containerized or remote Node.js environments (Docker, WSL)
Lightweight local HTTP bridge that delivers native desktop notifications for containerized or remote Node.js environments (Docker, WSL). Use
dev-notifyfor direct local Node.js notifications; usedev-notify-bridgewhen your app runs in an environment that cannot access the host desktop directly.
dev-notify-bridge is a tiny HTTP server that runs on your host machine and accepts JSON POST requests to trigger native desktop notifications (macOS Notification Center, Windows Toasts, Linux notify-send). It is intentionally minimal, secure by default, and intended for local development only.
A typical flow:
dev-notify-bridge on your host.node-notifier to show a native desktop notification.Note:
dev-notifyis a separate client-side package that sends notifications directly from local Node.js processes.dev-notify-bridgeis the host-side relay used when the app cannot show notifications itself.
Globally (recommended for developer machines):
npm install -g dev-notify-bridge
Or run without installing:
npx dev-notify-bridge
Start the bridge (default port 6789):
npx dev-notify-bridge
Start on a custom port:
PORT=5454 npx dev-notify-bridge
# or
npx dev-notify-bridge --port 5454
You should see:
dev-notify-bridge running at http://localhost:6789
💬 Ready to receive notifications
POST /notifyTriggers a native desktop notification.
Request JSON
{
"title": "string", // required
"message": "string", // required
"sound": true|false, // optional, default true
"wait": true|false // optional, default false
}
Success response (200)
{
"success": true,
"backend": "desktop",
"response": "Notification delivered",
"metadata": {
"hostname": "your-machine",
"platform": "darwin|win32|linux"
}
}
Error response (4xx/5xx)
{
"success": false,
"backend": "desktop",
"error": "Error message"
}
Example (curl)
curl -X POST http://localhost:6789/notify \
-H "Content-Type: application/json" \
-d '{"title":"Build OK","message":"API built successfully","sound":true}'
Run the bridge:
npx dev-notify-bridge [--port <port>] [--verbose]
Options:
--port, -p — server port (default 6789)--verbose, -v — enable verbose loggingEnvironment variable:
PORT — alternate way to set the port.1. Run a container and allow it to reach the host bridge
docker run --rm \
--add-host=host.docker.internal:host-gateway \
my-image
Inside the container, send a notification to the bridge:
// example using axios in container
await axios.post('http://host.docker.internal:6789/notify', {
title: 'Container Ready',
message: 'Service listening on :3000'
});
2. docker-compose (env var)
services:
api:
build: .
environment:
- DEV_NOTIFY_BRIDGE=http://host.docker.internal:6789
# For Linux hosts that need it:
# extra_hosts:
# - "host.docker.internal:host-gateway"
Using
--add-host=host.docker.internal:host-gatewayorextra_hostsis recommended for cross-platform resolution.
127.0.0.1 (localhost) for safety. Do not expose it publicly.--verbose to debug notification delivery during setup.host.docker.internal DNS not found (Linux)
Use --add-host=host.docker.internal:host-gateway when running the container, or set DEV_NOTIFY_BRIDGE to the host IP resolved by your environment.
No notification appears but API responded 200
node-notifier supports your platform (Linux may need notify-send available).--verbose to view bridge logs.Bridge fails to start (port in use)
Start with a different port: PORT=5454 npx dev-notify-bridge.
Contributions, issues, and feature requests are welcome.
Suggested workflow:
npm install and npm run build.Please follow standard code style.
MIT © 2025
FAQs
Lightweight local HTTP bridge that delivers native desktop notifications for containerized or remote Node.js environments (Docker, WSL)
We found that dev-notify-bridge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.