
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
It will take about 5 minutes to quickly launch a login server.
You need to have a nodejs runtime environment installed.
To install the application, run the following commands. This will download the package @khgame/loginsvr and install it in your global repository.
npm i -g @khgame/loginsvr
kh-loginsvr --version
Now, you will see current version to loginSvr in your console.
Hence, you should create a config file at the directory where you need the loginSvr to run.
You can manually create a new config file, but the recomended way is using the extract command.
cd /your/awwwwsome/running/directory
kh-loginsvr extract -p ./loginSvr.development.json
the extract command can be executed with the flag '-p', witch allows you specify the config name you can use this to create configs for different enviroments, e.g. loginSvr.production.json if it's didn't set, the default config name is ./loginSvr.development.json
After installation, you should got a config file like this: loginSvr.development.json
{
"name": "loginSvr",
"id": 0,
"port": 12001,
"setting": {
"log_prod_console": "info"
},
"drivers": {
"mongo": {
"host": "127.0.0.1",
"port": 27017,
"database": "loginSvr",
"username": "",
"password": ""
},
"redis": {
"db": 0,
"family": 4,
"host": "127.0.0.1",
"port": 6379,
"keyPrefix": "khgame:login:",
"key_mutex_wait_threshold": 100
},
"discover/consul": {
"optional": true,
"health": {
"api": "api/v1/core/health"
},
"did": {
"head_refresh": "process"
}
}
},
"rules": {
"admin_token": "FILL_THIS_FILED_WITH_RANDOM_STRING",
"renewal_time_span": 600,
"mail_option": {
"host": "smtp.exmail.qq.com",
"port": 465,
"secureConnection": true,
"auth": {
"user": "YOUR_EMAIL_ADDRESS",
"pass": "YOUR_EMAIL_PASS"
}
},
"active_host": "",
"frontend_host": "",
"validate_redirect": "https://www.github.com/bagaking",
"use_public_id": true,
"sign_in_tpl": "./tpl/sign_in.html",
"find_pwd_tpl": "./tpl/find_pwd.html",
}
}
Updates these config entries, replace then with your own setting.
structure of "rules":
export interface ILoginRule {
renewal_time_span: number;
mail_option: IMailOption;
/**
* name of all supported servers witch are provided by service discovery
*/
servers: string[];
/**
* url for usr active, only used in sign-in email, e.p. http://www.login-svr.com:11801/
*/
active_host?: string;
/**
* url for usr change pwd, only used in change-pwd email, e.p. http://game.cryptoheroes.co/
*/
frontend_host?: string;
/**
* url for redirection after url in validate email clicked, e.p. https://www.cryptoheroes.co/
*/
validate_redirect?: string;
/**
* determine which ip should be used when select server
*/
use_public_id: boolean;
/**
* template page of sign in
*/
sign_in_tpl: string;
/**
* template page of find pwd
*/
find_pwd_tpl: string;
}
for more information, you can check this document: Configuration
Finally, you can start the loginSvr, just use the command kh-loginsvr start.
This command will find the config file loginSvr.development.json, and then start the loginSvr using settings in the configuration file.
If the config are not given, it will running with the defult setting, just like the extract command provides.
therefore, you can also make your development enviroment match the default config to avoid these prepare operations
Alternatively, there are another ways to start up your login server.
kh-loginsvr start -p will start loginsvr with NODE_ENV=production, and the default config to search will be loginSvr.production.json.kh-loginsvr start -c my.awwwwsome.config.json will start loginsvr with specified config file.for more information, you can use the command
kh-loginsvr start -h
see Api
FAQs
dg-login is a out-of-box login server of decentralized game
The npm package dg-login receives a total of 1 weekly downloads. As such, dg-login popularity was classified as not popular.
We found that dg-login demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.