
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Telegram bot: @fluence_selectors_bot
Bot tries to parse incoming text via prepared selectors and decode them. Selectors are related to:
To interact with the bot you send your message and await that the message could be parsed via all possible selectors for you.
Prepare .env according to .example.env and run npm run dev
There are Foundry artifacts in src/abi directory. You can add (just copy files there), the bot recursively gets all ABI data
a9059cbb or 0xa9059cbb0x0431ea4d93af299b92f2c606ddcaf4b31cb0013c5ed1fdea837b8a912347c9650x5416eb988da5cb5b000000000000000000000000000000000000000000000000000000000x0af76b8f0000000000000000000000003d441ee4a0b65d8e3fe939b7b632152837be73fe0000000000000000000000000000000000000000000000056bc75e2d6310000003... or 04... or Amg7rBBsVeGC/Ufd6gsgD8Jqc7nHV8epXKFmu1XORo2/Bot tries to parse incoming text via prepared selectors and decode them. Selectors are related to:
- Ethereum features (addresses from private keys, other type of keys (Filecoin))
- Fluence contracts (function signatures, event signatures, error signatures, and decoding calldata)
- IPC contracts (function signatures, event signatures, error signatures, and decoding calldata)
- Fluence specific objects stored in Fluence contracts and Subgraph (e.g. PeerIds, CIDs, etc.)
To interact with the bot you send your message and await that the message could be parsed via all possible selectors for you.
Examples of messages:
ℹ️ Send me a message with a function selector to get the function signature.
<code>0xa9059cbb</code>
ℹ️ Send me a message with an event selector to get the event signature.
<code>0x0431ea4d93af299b92f2c606ddcaf4b31cb0013c5ed1fdea837b8a912347c965</code>
ℹ️ Send me a message with an error selector or full error data to get the error signature.
<code>0x5416eb988da5cb5b00000000000000000000000000000000000000000000000000000000</code>
ℹ️ Send me a message with calldata to get the function signature and decoded calldata.
<code>0x0af76b8f0000000000000000000000003d441ee4a0b65d8e3fe939b7b632152837be73fe0000000000000000000000000000000000000000000000056bc75e2d63100000</code>
ℹ️ Send me private or public key in any format (hex like in EVM or base64 from IPC) to get the address.
<code>Amg7rBBsVeGC/Ufd6gsgD8Jqc7nHV8epXKFmu1XORo2/</code>
ℹ️ Send me CIDv1 to get CID in Fluence Subgraph format (yes we have special <a href="https://github.com/fluencelabs/deal/blob/main/subgraph/src/mappings/utils.ts#L37">one</a>).
<code>bafkreids22lgia5bqs63uigw4mqwhsoxvtnkpfqxqy5uwyyerrldsr32ce</code>
ℹ️ Send me PeerId (base58) to get PeerId in hex format (the format that is used in Fluence contracts as well).
<code>12D3KooWCKCeqLPSgMnDjyFsJuWqREDtKNHx1JEBiwaMXhCLNTRb</code>
FAQs
Telegram bot: [@fluence_selectors_bot](https://t.me/fluence_selectors_bot)
We found that flbot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.