
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
docusaurus-plugin-multi-rss
Advanced tools
A powerful Docusaurus plugin for aggregating and displaying multiple RSS feeds with category filtering, batch processing, and TypeScript support
A powerful Docusaurus plugin for aggregating and displaying multiple RSS feeds with category filtering, batch processing, and full TypeScript support.
npm install docusaurus-plugin-multi-rss
# or
yarn add docusaurus-plugin-multi-rss
# or
pnpm add docusaurus-plugin-multi-rss
Create a rss-feeds.config.ts file in your project root:
export interface RSSFeedConfig {
url: string;
category: string;
title: string;
}
export const rssFeeds = {
'krebs-security': {
url: 'https://krebsonsecurity.com/feed/',
category: 'cyber',
title: 'Krebs on Security'
},
'hacker-news': {
url: 'https://hnrss.org/frontpage',
category: 'tech',
title: 'Hacker News'
},
// Add more feeds...
};
export const rssPluginOptions = {
maxItemsPerFeed: 20,
concurrency: 4,
enableSeparateFiles: true,
timeout: 15000,
};
Add the plugin to your docusaurus.config.ts:
import { rssFeeds, rssPluginOptions } from './rss-feeds.config';
const config = {
// ... other config
plugins: [
[
'docusaurus-plugin-multi-rss',
{
...rssPluginOptions,
feeds: rssFeeds
}
]
]
};
export default config;
The plugin generates several JSON files in .docusaurus/docusaurus-plugin-multi-rss/default/:
rss-data.json - Complete RSS data with all feedsfeed-{feedKey}.json - Individual feed datacategory-{category}.json - Category-grouped itemslatest-items.json - 50 most recent items across all feedsrss-stats.json - Feed statistics and health statusimport React from 'react';
function MyRSSPage() {
// Import generated RSS data
const rssData = require('@site/.docusaurus/docusaurus-plugin-multi-rss/default/rss-data.json');
return (
<div>
<h1>Latest News</h1>
{rssData.allItems.slice(0, 10).map((item) => (
<article key={item.guid}>
<h2>
{item.link ? (
<a href={item.link} target="_blank" rel="noopener noreferrer">
{item.title}
</a>
) : (
item.title
)}
</h2>
<p>{item.summary}</p>
<small>
{item.feedTitle} • {new Date(item.publishedDate).toLocaleDateString()}
</small>
</article>
))}
</div>
);
}
export default MyRSSPage;
| Option | Type | Default | Description |
|---|---|---|---|
feeds | Record<string, FeedConfig> | {} | RSS feed definitions |
maxItemsPerFeed | number | 20 | Maximum items to fetch per feed |
concurrency | number | 5 | Number of feeds to fetch concurrently |
enableSeparateFiles | boolean | true | Generate separate JSON files for feeds/categories |
timeout | number | 10000 | Request timeout in milliseconds |
Each feed can be configured with:
{
url: string; // RSS feed URL (required)
category?: string; // Category for organization (default: 'general')
title?: string; // Custom title override (defaults to feed's title)
}
interface RSSData {
feeds: Record<string, ProcessedFeed>; // All feeds by key
categories: Record<string, RSSItem[]>; // Items grouped by category
allItems: RSSItem[]; // All items sorted by date
lastUpdated: string; // ISO timestamp
stats: {
totalFeeds: number;
successfulFeeds: number;
failedFeeds: number;
totalItems: number;
categoryCounts: Record<string, number>;
};
}
interface RSSItem {
title?: string;
link?: string;
pubDate?: string;
description?: string;
content?: string;
author?: string;
categories?: string[];
// Enhanced fields added by plugin
feedKey?: string;
feedTitle?: string;
category?: string;
cleanTitle?: string;
publishedDate?: Date;
summary?: string;
}
See the examples/basic directory for a complete working example.
// Load only cyber security feeds
const cyberFeeds = require('@site/.docusaurus/docusaurus-plugin-multi-rss/default/category-cyber.json');
function CyberNews() {
return (
<div>
<h1>Cybersecurity News</h1>
{cyberFeeds.items.map(item => (
<article key={item.guid}>
<h2>{item.title}</h2>
<p>{item.summary}</p>
</article>
))}
</div>
);
}
const latestItems = require('@site/.docusaurus/docusaurus-plugin-multi-rss/default/latest-items.json');
function LatestNews() {
return (
<div>
<h1>Latest from All Feeds</h1>
{latestItems.map(item => (
<article key={item.guid}>
<h2><a href={item.link}>{item.title}</a></h2>
<small>{item.feedTitle} • {item.category}</small>
</article>
))}
</div>
);
}
const stats = require('@site/.docusaurus/docusaurus-plugin-multi-rss/default/rss-stats.json');
function FeedStats() {
return (
<div>
<h2>Feed Statistics</h2>
<p>Total Feeds: {stats.totalFeeds}</p>
<p>Successful: {stats.successfulFeeds}</p>
<p>Failed: {stats.failedFeeds}</p>
<p>Total Items: {stats.totalItems}</p>
<h3>By Category</h3>
<ul>
{Object.entries(stats.categoryCounts).map(([cat, count]) => (
<li key={cat}>{cat}: {count} items</li>
))}
</ul>
</div>
);
}
This plugin fetches RSS feeds at build time. To keep content fresh, you have several options:
Create .github/workflows/update-rss-feeds.yml:
name: Update RSS Feeds
on:
schedule:
- cron: '0 7 * * *'
# Allow manual triggering from Actions tab
workflow_dispatch:
# Also run on push to main (for immediate updates after config changes)
push:
branches:
- main
paths:
- 'rss-feeds.config.ts'
- 'docusaurus.config.ts'
- '.github/workflows/update-rss-feeds.yml'
jobs:
update-and-deploy:
runs-on: ubuntu-latest
permissions:
contents: write
pages: write
id-token: write
environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}
steps:
- name: Checkout repository
uses: actions/checkout@v4
with:
fetch-depth: 0 # Full history for git operations
- name: Checkout Intel Codex Vault
uses: actions/checkout@v4
with:
repository: gl0bal01/intel-codex
path: .temp-vault
fetch-depth: 1
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
- name: Install dependencies
run: npm ci
- name: Build site (fetches fresh RSS feeds)
run: npm run build
env:
NODE_ENV: production
- name: Upload artifact
uses: actions/upload-pages-artifact@v3
with:
path: ./build
- name: Deploy to GitHub Pages
id: deployment
uses: actions/deploy-pages@v4
- name: Notify on failure
if: failure()
run: |
echo "RSS feed update failed at $(date)"
# Optional: Add notification service here (Discord webhook, email, etc.)
Pros: Simple, works with GitHub Pages, no backend needed Cons: Limited to hourly updates, uses GitHub Actions minutes
Add a refresh button using RSS proxy services:
const [items, setItems] = useState(buildTimeData);
const refreshFeeds = async () => {
const proxy = 'https://api.rss2json.com/v1/api.json?rss_url=';
const response = await fetch(proxy + encodeURIComponent(feedUrl));
const data = await response.json();
setItems(data.items);
};
See docs/client-side-fetching.md for more details.
Deploy a serverless function (Vercel/Netlify/Cloudflare) for real-time updates.
See docs/server-side-api.md for implementation guide.
This plugin includes built-in security measures to protect against XSS attacks from malicious RSS feeds:
All URLs from RSS feeds (item links, feed links, and enclosure URLs) are automatically sanitized at build time to prevent XSS attacks. The sanitization:
javascript:, data:, vbscript:, file:, about:http:, https:, mailto:, ftp:Blocked URLs are set to undefined, so always check if a link exists before rendering:
{item.link ? (
<a href={item.link} target="_blank" rel="noopener noreferrer">
{item.title}
</a>
) : (
<span>{item.title}</span>
)}
For defense-in-depth, consider adding client-side URL sanitization as well. See the example file for a complete implementation with both backend and frontend sanitization.
rel="noopener noreferrer" when rendering external links with target="_blank"This plugin is written in TypeScript and includes full type definitions. Import types:
import type {
RSSData,
RSSItem,
ProcessedFeed,
FeedConfig,
PluginOptions
} from 'docusaurus-plugin-multi-rss';
npm run clearnpm run buildThis plugin fetches feeds at build time, not in the browser, so CORS is not an issue.
Increase the timeout option if feeds are slow to respond:
{
timeout: 30000 // 30 seconds
}
Lower the concurrency option to fetch fewer feeds simultaneously:
{
concurrency: 2 // Fetch 2 feeds at a time
}
Contributions are welcome! Please:
MIT License - see LICENSE file for details
⭐ Star this repo if you find it helpful.
FAQs
A powerful Docusaurus plugin for aggregating and displaying multiple RSS feeds with category filtering, batch processing, and TypeScript support
The npm package docusaurus-plugin-multi-rss receives a total of 1 weekly downloads. As such, docusaurus-plugin-multi-rss popularity was classified as not popular.
We found that docusaurus-plugin-multi-rss demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.