
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Library in typescript for sending multicast notifications using HTTP/2 multiplexing and the FCM HTTP v1 API.
Library in typescript for sending multicast notifications using HTTP/2 multiplexing and the FCM HTTP v1 API.
Features supported by fcm-http2:
For NodeJS applications, installation is done as follows:
npm install fcm-http2
For Deno applications, installation is as follows:
import { FCM } from 'https://esm.sh/fcm-http2';
Once the library has been installed you can start using it in this way.
Option for CommonJS with file:
// FCM library recovery
const FCM = require('fcm-http2').FCM;
// Basic configuration for FCM
const fcmOptions = {
// Pass in your service account JSON private key file (https://console.firebase.google.com/u/0/project/_/settings/serviceaccounts/adminsdk)
serviceAccount: require('./service-account.json'),
// Max number of concurrent HTTP/2 sessions (connections)
maxConcurrentConnections: 10,
// Max number of concurrent streams (requests) per session
maxConcurrentStreamsAllowed: 100
};
// Init FCM with options
const fcmClient = new FCM(fcmOptions);
Option for ESM (JavaScript/TypeScript) with file:
// FCM library recovery
import { FCM, FcmBaseOptions } from 'fcm-http2';
// Basic configuration for FCM
const fcmOptions: FcmBaseOptions = {
// Pass in your service account JSON private key file (https://console.firebase.google.com/u/0/project/_/settings/serviceaccounts/adminsdk)
serviceAccount: require('./service-account.json'),
// Max number of concurrent HTTP/2 sessions (connections)
maxConcurrentConnections: 10,
// Max number of concurrent streams (requests) per session
maxConcurrentStreamsAllowed: 100
};
// Init FCM with options
const fcmClient = new FCM(fcmOptions);
Option for CommonJS without file:
// FCM library recovery
const FCM = require('fcm-http2').FCM;
// Basic configuration for FCM
const fcmOptions = {
// Pass in your service account JSON private key file (https://console.firebase.google.com/u/0/project/_/settings/serviceaccounts/adminsdk)
// NOTE: Recover the three parameters from the service-account.json file
serviceAccount: {
project_id: '<project_id>',
private_key: '<private_key>',
client_email: '<client_email>'
},
// Max number of concurrent HTTP/2 sessions (connections)
maxConcurrentConnections: 10,
// Max number of concurrent streams (requests) per session
maxConcurrentStreamsAllowed: 100
};
// Init FCM with options
const fcmClient = new FCM(fcmOptions);
Option for ESM (JavaScript/TypeScript) without file:
// FCM library recovery
import { FCM, FcmBaseOptions } from 'fcm-http2';
// Basic configuration for FCM
const fcmOptions: FcmBaseOptions = {
// Pass in your service account JSON private key file (https://console.firebase.google.com/u/0/project/_/settings/serviceaccounts/adminsdk)
// NOTE: Recover the three parameters from the service-account.json file
serviceAccount: {
project_id: '<project_id>',
private_key: '<private_key>',
client_email: '<client_email>'
},
// Max number of concurrent HTTP/2 sessions (connections)
maxConcurrentConnections: 10,
// Max number of concurrent streams (requests) per session
maxConcurrentStreamsAllowed: 100
};
// Init FCM with options
const fcmClient = new FCM(fcmOptions);
Only option:
// FCM library recovery
import { FCM, FcmBaseOptions } from 'https://esm.sh/fcm-http2';
// Basic configuration for FCM
const fcmOptions: FcmBaseOptions = {
// Pass in your service account JSON private key file (https://console.firebase.google.com/u/0/project/_/settings/serviceaccounts/adminsdk)
// NOTE: Recover the three parameters from the service-account.json file
serviceAccount: {
project_id: '<project_id>',
private_key: '<private_key>',
client_email: '<client_email>'
},
// Max number of concurrent HTTP/2 sessions (connections)
maxConcurrentConnections: 10,
// Max number of concurrent streams (requests) per session
maxConcurrentStreamsAllowed: 100
};
// Init FCM with options
const fcmClient = new FCM(fcmOptions);
// NOTE: Use the fcmClient object that you created earlier
// Token to send the notification to
const tokens = ['TOKEN_1', 'TOKEN_N'];
// Composing the message to be sent
const message = {
notification: {
title: "Test",
body: "Multiple Send"
},
data: {
notification: "true"
}
};
// Multiple sending of notification using token array
fcmClient.sendMulticast(message, tokens).then((unregisteredTokens: Array<string>) => {
// Sending successful
console.log('Message sent successfully');
// Remove unregistered tokens from your database
if (unregisteredTokens.length > 0) {
console.log('Unregistered device token(s): ', unregisteredTokens.join(', '));
}
}).catch((error: object) => console.log(error));
For any doubts open an issue or contact this email fctaddia@duck.com
2.7.0 (2025-12-24)
IMPORTANT: The minimum NodeJS version is now 18
FAQs
Library in typescript for sending multicast notifications using HTTP/2 multiplexing and the FCM HTTP v1 API.
The npm package fcm-http2 receives a total of 227 weekly downloads. As such, fcm-http2 popularity was classified as not popular.
We found that fcm-http2 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.