
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
This project hosts a CommonJS-compatible version of [easyXDM](https://github.com/oyvindkinsey/easyXDM) that can easily be rebuilt with `make`.
This project hosts a CommonJS-compatible version of easyXDM that can easily be rebuilt with make.
The official repo includes a version of easyXDM that is not CommonJS-compatible and always defines window.easyXDM. The one built here should never define a global.
var easyxdm = require('easyxdm');
var iframeRpc = new easyxdm.Rpc({
remote: apiHost + "/easyxdm.html"
},
{
remote: {
request: {}
}
});
EasyXDM comes with a 'debug' mode which console.logs (or a window.opened log in IE9) a lot of what's going on as it passes messages around. To use this mode, var easyxdm = require('easyxdm/debug').
The default make target in the Makefile is build. Build does a few things:
VERSION environment variable before running make. e.g. make VERSION='2.14.9'.sed to insert the version number.Requiring this module will throw an Error if the following globals are not defined: window, document, location. Browserify does this for you. If, for some reason, you need to require this module in vanilla node, you can use jsdom:
var document = require('jsdom').jsdom();
var window = document.parentWindow;
var location = window.location;
var easyxdm = require('easyxdm');
FAQs
This project hosts a CommonJS-compatible version of [easyXDM](https://github.com/oyvindkinsey/easyXDM) that can easily be rebuilt with `make`.
We found that easyxdm demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.