
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Build data structures by using data-shapes. The data-shape should looks like that:
const dtShape = require ( 'dt-shape' )
let shape = {
'name' : [ 'firstName' , 'name' ] // -> list of possible sources
/* ^ ^ ^
| | +---> top priority is always in the end
| +---> search for values in these keys
|
Create property with this name
*/
}
// Important! Data should be provided as dt-object. If is not - convert it first.
// dt-shape contains compatible version of dt-box.
const dtbox = dtShape.getDTtoolbox ()
// Use dt-toolbox library:
let dt = dtbox.init(data)
// Build data according shape. Result will be a dt-object.
let resultDT = dtShape ( dt , shape )
// If you need a standard JS object, dt-object has a convertor by calling a 'model' function:
let jsObject = dtShape ( dt, shape ).model (()=>({'as':'std'}))
DT object is an object created by library dt-toolbox. It's a tool for handle a heavy javascript structures. You can manipulate, reshape or/and extract the information of it. Immutability is taken as consideration by this library.
Read more about DT on dt-toolbox page.
Install node package:
npm install dt-shape --save
Once it has been installed, it can be used by writing this line of JavaScript code:
import dtShape from 'dt-shape'
or require it:
const dtShape = require ( 'dt-shape' )
dtShape is simple function that have two arguments - (source data, data shape) and returns a result as it explained in the data shape.
Source data should be dt-object. Any standard javascript structure can be converted to DT by single row of code.
// Always load dt-toolbox from dtShape library
// This will preserve compatibility among library versions
let
dtbox = dtShape.getDTtoolbox ()
, dt = dtbox.init( jsObject )
;
Data shape represents connection between source data and result object. Keys will become a result property names. Values are source data keys where dtShape function will search for data. Values of the shape object are always array. Simple example:
let shape = { 'newName' : ['firstName']}
This shape creates object with property 'newName'. Value for 'newName' is taken from source data object, property 'firstName' . Shape values can contain more than one member.
let shape = { 'newName' : ['firstName','name'] }
This example says that result should have property 'newName' and value should be in keys 'firstName' or 'name' of the source data. This make possible to use same data shape with large variety of source data structures and result will be the same. Priority is always on last member of the array.
Keys can contain prefixes like list!, fold!, and load!.
fold! prefix will search for properties and will fold them inside object. Example:
// shape with fold
let shape = { 'fold!name' : ['firstName','lastName']}
/*
expected result should have
{
name : {
firstName : 'someValue'
, lastName : 'someOtherValue'
}
}
*/
list! prefix will return list of values
// shape with fold
let shape = { 'list!family' : ['spouse','wife','kid']}
/*
expected result should have
{
family : [ 'spouseName', 'wifeName', 'eventualKidName' , 'OtherKidName' ]
}
*/
load! prefix loads data from external source. Source could be function, primitive or object.const
dtbox = dtShape.getDTtoolbox ()
, name = 'Peter'
, shape = { 'load!firstName' : [ name ] }
;
let sourceData = dtbox.init ({ 'root/name' : 'Ivo' });
let result = dtShape ( sourceData, shape ).model(()=>({as:'std'}));
/*
->
{
firstName : 'Peter'
}
*/
const
dtShape = require ( 'dt-shape' )
, dtbox = dtShape.getDTtoolbox ()
;
let source = {
firstName : 'Peter'
, familyName : 'Naydenov'
};
// convert object to DT
let dtSource = dtbox.init ( source );
// Prepare the shape
let userShape = {
'userName' : [ 'firstName' ]
'profile/name' : [ 'firstName' ]
, 'profile/lastName' : [ 'familyName']
}
let user = dtShape ( dtSource, userShape ).model ( () => ({as:'std'}))
/*
user should be:
{
userName: 'Peter'
, profile: {
name: 'Peter'
, lastName: 'Naydenov'
}
}
*/
Find some examples in ./test folder.
(Nothing yet)
dt-toolbox to ver. 7.4.2;dt-toolbox to ver. 7.4.1;dt-toolbox to ver. 7.4.0;dt-toolbox to ver. 7.2.0;dt-toolbox to ver. 6.0.0;dt-toolbox to ver. 4.0.7;dt-toolbox to ver. 4.0.6;dt-toolbox to ver. 3.1.0;dt-toolbox;load! loads data from external source;'dt-shape' was created by Peter Naydenov.
'dt-shape' is released under the MIT License.
FAQs
Build data by using shapes
We found that dt-shape demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.