
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
dexnode - Commandline Utility for Deopt Explorer.dexnode is a commandline wrapper for the NodeJS executable (node) designed to simplify the process of launching Node
with the necessary arguments required to produce a log that can be consumed by Deopt Explorer. When launched,
dexnode will attempt to determine the correct logging and tracing options based on the detected version of NodeJS.
npm install --global dexnode
# NodeJS (via global install)
dexnode myscript.js
# NodeJS (via `npm exec`)
npm exec dexnode myscript.js
# Deno (via `deno run`)
deno run -A npm:dexnode myscript.js
dexnode [options] [--] <executable> [executable_options]
options:
-h --help print this message
--no-maps exclude v8 maps from log
--no-ics exclude ics from log
--no-deopts exclude deopts from log
--no-profile exclude cpu profile from log
--no-sources exclude sources from log
--no-quiet write dexnode messages to stdout (default)
--maps include v8 maps in log (default)
--ics include ics in log (default)
--deopts include deopts in log (default)
--profile include cpu profile in log (default)
--sources include sources in log (default)
--quiet do not write dexnode messages to stdout
--out FILE write all log output to FILE (default: isolate-<pid>-<isolate id>-v8.log)
-- pass all remaining arguments to node
FAQs
Run NodeJS with logging options needed by Deopt Explorer
The npm package dexnode receives a total of 453 weekly downloads. As such, dexnode popularity was classified as not popular.
We found that dexnode demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.