
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
fred-copy-paste
Advanced tools
A command line utility that allows read/write (i.e copy/paste) access to the system clipboard.
A command line utility that allows read/write (i.e copy/paste) access to the system clipboard. It does this by wrapping pbcopy/pbpaste (for OSX), xclip (for Linux, FreeBSD, and OpenBSD), and clip (for Windows). Currently works with node.js v0.8+.
When require("copy-paste") is executed, an object with the following properties is returned:
copy(text[, callback]): asynchronously replaces the current contents of the clip board with text. Takes either a string, array, object, or readable stream. Returns the same value passed in. Optional callback will fire when the copy operation is complete.
paste([callback]): if no callback is provided, paste synchronously returns the current contents of the system clip board. Otherwise, the contents of the system clip board are passed to the callback as the second parameter.
Note: The synchronous version of paste is not always availabled. Unfortunately, I'm having a hard time finding a synchronous version of child_process.exec that consistently works on all platforms, especially windows. An error message is shown if the synchronous version of paste is used on an unsupported platform. That said, the asynchronous version of paste is always available.
require("copy-paste").global(): adds copy and paste to the global namespace. Returns an object with copy and paste as properties.
var ncp = require("copy-paste");
ncp.copy('some text', function () {
// complete...
})
The easiest way to get node-copy-paste is with npm:
npm install -g copy-paste
Alternatively you can clone this git repository:
git clone git://github.com/xavi-/node-copy-paste.git
I'm hoping to add various fallbacks for instances when xclip or clip is not avaiable (see experimental-fallbacks branch). Also this library needs to be more thoroughly tested on windows.
This project is released under The MIT License.
FAQs
A command line utility that allows read/write (i.e copy/paste) access to the system clipboard.
We found that fred-copy-paste demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.