
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Scales an N-dimensional array to perfectly fit within a bounding box, maintaining proportions.
fitDim scales an N-dimensional array to perfectly fit within a bounding box, maintaining proportions. It supports both upscaling and downscaling to ensure the best possible fit.
npm install fitdim
import { fitDim } from 'fitdim';
const dims = [1920, 1080];
const maxDims = [1280, 800];
// ✅ Scales down to fit perfectly inside [1280, 800]
console.log(fitDim(dims, maxDims));
// [1280, 720]
// ✅ Scales up to fit inside [600, 800, 1000]
console.log(fitDim([300, 400, 500], [600, 800, 1000]));
// [600, 800, 1000]
// ✅ Slight upscaling to fit inside [400, 500, 600]
console.log(fitDim([300, 400, 500], [400, 500, 600]));
// [400, 500, 600]
// ✅ No change (already fits)
console.log(fitDim([300, 400, 500], [300, 400, 500]));
// [300, 400, 500]
fitDim(dims: number[], maxDims: number[]): number[]Scales an N-dimensional array so that it fits perfectly within the given bounding box (maxDims), while maintaining proportions.
dims – The original array of dimensions (e.g., [width, height, depth]).maxDims – The bounding box (maximum allowed dimensions).dims.length and maxDims.length do not match.These patterns help apply common transformations using fitDim!
import fitDim from 'fitdim';
// 🔢 Round the result (Ceil, Floor, Nearest)
const dims = fitDim([1920, 1080], [1280, 800]);
const roundedDims = dims.map(Math.round);
// or use Math.floor / Math.ceil
// 🔍 Check if a resize occurred
const original = [1920, 1080];
const maxDims = [1280, 800];
const fitted = fitDim(original, maxDims);
const wasResized = !original.every((dim, i) => dim === fitted[i]);
console.log(wasResized); // true
These link might be suffixed with "-node" in the future if conflicts arise.
https://github.com/alexstevovich/fitdim
This link might be suffixed with "-node" in the future if conflicts arise.
Licensed under the Apache License 2.0.
FAQs
Scales an N-dimensional array to perfectly fit within a bounding box, maintaining proportions.
The npm package fitdim receives a total of 1 weekly downloads. As such, fitdim popularity was classified as not popular.
We found that fitdim demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.