
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
This helper class can be used to simplify the interaction with EdgeKV in EdgeWorker code. It abstracts away the complexity into a few lines of code.
Original code is https://github.com/akamai/edgeworkers-examples/tree/master/edgekv/lib
Your EdgeKV tokens can be passed to the constructor.
npm install edgekv --save
Then, put edgekv_tokens.js file along with main.js. edgekv_tokens.js can be created by Akamai CLI.
JavaScript module bundler would help you to embed this module into main.js.
rollup.js for example, with following rollup.config.js will generate code bundle efficiently. Then create tgz file at dist directory.
import resolve from "@rollup/plugin-node-resolve";
import commonjs from "@rollup/plugin-commonjs";
export default {
input: ["src/main.js", "src/bundle.json", "src/edgekv_tokens.js"],
external: [
'create-response',
'http-request',
'cookies',
'text-encode-transform',
'url-search-params',
'streams',
'log',
'resolvable'
],
preserveModules: false,
output: {
dir: "dist",
format: "es"
},
plugins: [
commonjs(),
resolve()
]
};
Constructor to allow setting default namespace, group and token. These defaults can be overriden when making individual GET, PUT, and DELETE operations
import { edgekv_access_tokens } from './edgekv_tokens.js';
const ekv = new EdgeKV("namespace", "group", edgekv_access_tokens);
async GET text from an item in the EdgeKV.
let text = await ekv.getText({item: 'key'});
async GET json from an item in the EdgeKV.
let object = await ekv.getJson({item: 'key'});
async PUT text into an item in the EdgeKV.
await ekv.putText({item: 'key', value: 'foo'});
PUT text into an item in the EdgeKV while only waiting for the request to send and not for the response.
await ekv.putTextNoWait({item: 'key', value: 'foo'});
async PUT json into an item in the EdgeKV.
await ekv.putJson({ item: 'key', value: {name: 'foo', description: 'bar'} });
PUT json into an item in the EdgeKV while only waiting for the request to send and not for the response.
await ekv.putJsonNoWait({ item: 'key', value: {name: 'foo', description: 'bar'} });
async DELETE an item in the EdgeKV.
await ekv.delete({item: 'key'});
DELETE an item in the EdgeKV while only waiting for the request to send and not for the response.
await ekv.deleteNoWait({item: 'key'});
All errors coming from the use of the EdgeKV class will be in the following format:
{
"failed": "whatFailed",
"status": responseStatusCode,
"body": "descriptionOfFailure"
}
try {
const edgeKv = new EdgeKV({ group: "ProductSalePrice" }); // the namespace will be "default" if it is not provided
let salePrice = await edgeKv.getText({ item: productId, default_value: "N/A" });
// use the salePrice in the page
} catch (error) {
// do something in case of an error
}
try {
const edgeKv = new EdgeKV({ group: "LastUpdated" });
let date = new Date().toString();
await edgeKv.putText({ item: productId, value: date });
// this information can then be used to see when a product was last updated
} catch (error) {
// do something in case of an error
}
try {
const edgeKv = new EdgeKV({ group: "LastUpdated" });
let date = new Date().toString();
edgeKv.putTextNoWait({ item: productId, value: date });
// this information can then be used to see when a product was last updated
} catch (error) {
// do something in case of an error
}
Please see the examples tagged "EKV" here for example usage of this helper library.
For information on using EdgeWorkers and EdgeKV, please review Akamai's product policy
FAQs
EdgeKV helper library
We found that edgekv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.