
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
field-caser
Advanced tools
field-caser is a project that allows you to do one thing, and one thing only... switch field names from various formats like:
foo_barfooBarfoo-barI found it annoying to map JSON from older (or opinionated) REST endpoints that use snake case to camel case. This is often the case when using TypeScript in the Node.js and browser world, especially if you're typing all of your outputs. While other frameworks add this feature, this is naked for you to use at your discretion.
And yes, this is a deep conversion. It will recurse and find all of the child objects and arrays (naive, depth first).
To use field-caser first install it via npm:
npm install --save field-caser
Or yarn:
yarn add field-caser
There's a very simple little Node application under the example directory that demonstrates usage in TypeScript.
Essentially:
const snakeUser = {
first_name: 'Homer',
last_name: 'Simpson'
}
interface User {
firstName: string,
lastName: string
}
const camelUser: User = <User>transformAllFieldNamesToCamel(snakeUser)
You don't need to type the input, as we utilize the unknown type for this (since you probably don't want to bother typing the "bad" shapes).
As usual, since this is TypeScript, there's no guarantee that your input truly matches since that would need a run time check. So caveat emptor.
FAQs
Deep convert Javascript field names casing styles.
We found that field-caser demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.