
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A fjåge Gateway implementation in JavaScript supports both browser (WebSocket) and Node.js (TCP) based connections to a fjåge Master Container.
fjage.js is included as a part of the fjage.jar package and also available seperately as a npm package.
fjage.js v2.0.0 enables automatic registration of subscriptions with the master container using WANTS_MESSAGES_FOR action. This is done everytime a fjage.js client subscribes to a topic. A change in fjåge to support a non-aggregating WebSocketConnector enable this performance improvement in fjage.js. This is a breaking change from fjage.js v1.x.x, where all messages were sent to all fjage.js clients.
The change doesn't affect the usage of fjage.js in the browser, but it does make fjage.js ≥2.0.0 incompatible with fjåge < 2.0.0.
$ npm install fjage
The API documentation of the latest version of fjage.js is published at https://org-arl.github.io/fjage/jsdoc/
A distribution-ready bundle is available for types of module systems commonly used in the JS world. Examples of how to use it for the different module systems are available in the examples directory.
At runtime, fjage.js will check its context (browser or Node.js) and accordingly use the appropriate Connector for connecting to the master container.
const { Performative, AgentID, Message, Gateway, MessageClass } = require('fjage');
const shell = new AgentID('shell');
const gw = new Gateway({
hostname: 'localhost',
port : '5081',
});
import { Performative, AgentID, Message, Gateway, MessageClass } from 'fjage.js'
const shell = new AgentID('shell');
const gw = new Gateway({
hostname: 'localhost',
port : '5081',
});
<script src="fjage.min.js"></script>
<script>
const shell = new fjage.AgentID('shell');
const gw = new fjage.Gateway({
hostname: 'localhost',
port : '8080',
pathname: '/ws/'
});
</script>
FAQs
JS Gateway for fjåge
We found that fjage demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.