
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Many functions that require a duration, require passing just a number value. This makes it to find out if the duration is in seconds, milliseconds or other.
sleep(1_000); // are these seconds? milliseconds?
sleep(Duration.seconds(1).toMilliseconds());
// OR
sleep(Duration("1 second").toMilliseconds());
Hey, I'm Nils. In my spare time I write about things I learned or I create open source packages, that help me (and hopefully you) to build better apps.
You can install this package with any package manager you like.
pnpm add duri
const time = Duration.seconds(5);
const timeInMilliseconds = time.toMilliseconds(); // 5_000 milliseconds
// Callable factory with string input
const duration = Duration("5 seconds");
duration.toSeconds(); // 5
// Compact forms (no space)
Duration("1s"); // 1 second
Duration("500ms"); // 500 milliseconds
Duration("10m"); // 10 minutes
Duration("2h"); // 2 hours
// Aliases supported (case-insensitive)
Duration("5 sec");
Duration("10 min");
Duration("2 hr");
Duration("500 milliseconds");
// Decimals and underscores
Duration("1.5 hours"); // 1.5 hours
Duration("1_000 seconds"); // 1000 seconds
// Whitespace is flexible
Duration(" 5 seconds ");
// Direct numeric input (seconds)
const duration = new Duration(5); // 5 seconds
second, seconds, not secs)"1 hour 30 minutes" are not supportedTypeError"5" will throw TypeErrorms, millisecond, millisecondss, sec, second, secondsm, min, minute, minutesh, hr, hour, hours// These throw TypeError:
Duration("5"); // No unit
Duration("-5 seconds"); // Negative
Duration("1,000 seconds"); // Comma separator
Duration("5 days"); // Unsupported unit
Duration("1h30m"); // Multi-unit
I highly appreceate your feedback! Please create an issue, if you've found any bugs or want to request a feature.
FAQs
A tiny library for working with durations.
We found that duri demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.