
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A simple and easy-to-use communication SDK for WuKongIM, based on its JSON-RPC protocol.
npm install easyjssdk
| Platform | Status | Notes |
|---|---|---|
| Browser | ✅ | Native WebSocket |
| Node.js | ✅ | Via ws (auto-installed as optional dependency) |
| WeChat Mini Program | ✅ | Uses wx.connectSocket |
| Alipay Mini Program | ✅ | Uses my.connectSocket |
| UniApp | ✅ | Uses uni.connectSocket |
The SDK is fully compatible with WeChat Mini Program npm build:
npm install easyjssdk
const { WKIM, WKIMChannelType, WKIMEvent } = require('easyjssdk');
The miniprogram field in package.json points to the CJS build, so the mini program build tool can locate the entry correctly. The ws dependency is optional and will not be bundled.
import { WKIM, WKIMChannelType, WKIMEvent } from 'easyjssdk';
// 1. Initialization
const im = WKIM.init("ws://your-wukongim-server.com:5200", {
uid: "your_user_id", // Your user ID
token: "your_auth_token" // Your authentication token
// deviceId: "optional_device_id", // Optional device ID
// deviceFlag: 2 // Optional device flag (1:APP, 2:WEB, default is 2)
});
// 2. Receive messages
im.on(WKIMEvent.Message, (message) => {
console.log("Received message:", message);
// Process received message (message.payload, message.fromUid, etc.)
});
// 2.1 Receive custom event notifications
im.on(WKIMEvent.CustomEvent, (event) => {
console.log("Received event:", event);
// Handle custom events from server
// event = { id, type, timestamp, data }
});
// For more events, see:
// https://github.com/WuKongIM/EasyJSSDK/blob/main/example/app.js#L132
// 3. Connect to the server
await im.connect()
// 4. Example: Send a message after successful connection
const targetChannelID = "friend_user_id"; // Target user ID
const messagePayload = { type: 1, content: "Hello from EasyJSSDK!" };
const sendResult = await im.send(targetChannelID, WKIMChannelType.Person, messagePayload);
// sendResult.reasonCode
The package ships dual builds:
dist/esm/) — for modern bundlers and import syntaxdist/cjs/) — for require(), Node.js, and mini program environmentsThe exports field in package.json handles automatic resolution:
// package.json (excerpt)
{
"main": "dist/cjs/index.js", // CJS entry
"module": "dist/esm/index.js", // ESM entry
"types": "dist/esm/index.d.ts", // TypeScript types
"miniprogram": "dist/cjs" // WeChat Mini Program entry
}
The SDK supports the Event Protocol, allowing you to receive custom event notifications from the server:
// Listen for custom events
im.on(WKIMEvent.CustomEvent, (event) => {
console.log('Event Type:', event.type);
console.log('Event Data:', event.data);
// Handle different event types
switch (event.type) {
case 'user.status.changed':
updateUserStatus(event.data);
break;
case 'system.announcement':
showAnnouncement(event.data);
break;
}
});
Event Structure:
id - Unique event identifiertype - Event type (e.g., "user.status.changed")timestamp - Event timestamp in millisecondsdata - Event payload (automatically parsed from JSON)See also:

npm install.npm run build to compile TypeScript (outputs both ESM and CJS).npm test to run the test suite.This repository includes a simple HTML/JS example to test the SDK.
npm run build
# npm install -g http-server
http-server .
http://localhost:8080/example/FAQs
WuKongIM Easy SDK for JavaScript
We found that easyjssdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.