
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
generator-ayen
Advanced tools
Yeoman generator for a full stack, testable, web app development workflow with Browserify, Jade, Stylus/SASS/LESS, Gulp and Bower

Yeoman generator with Anything You'll Ever Need to write a single-page app. Features live-reloading development workflow, Browserify, Bower integration, Jade templates, a CSS preprocessor and testing tools.
WARNING: This generator is still in flux. Expect breaking changes.
Yeoman is a project scaffolding tool. You install it from npm by running:
npm install -g yo
To install generator-ayen from npm, run:
npm install -g generator-ayen
Ayen projects need Gulp to work. You know the drill:
npm install -g gulp
Pick a good spot on your hard drive for your project and cd to it:
mkdir my-new-app
cd my-new-app
Initiate the generator:
yo ayen
Now just answer all the questions truthfully and you're done.
P.S.: Did you know you can run yo ayen again even after you've already scaffolded an app? Yeoman will help you resolve conflicting files, so don't worry about losing your work if you re-scaffold.
Ayen knows to play nice with your project even after you've done some work, so don't hesitate to upgrade your build environment whenever a new version of ayen is out.
Start the watcher:
gulp watch
A browser window will pop out. It will reload whenever you make a change to a file.
At this point, you can start hacking away with your favorite text editor.
You will find browser-side code in ./client and server-side code in ./server.
gulp build:dist
This builds for production and outputs the results in ./public.
gulp build
This builds a minimal development build in ./public. It contains symlinks, so you may not want to move it around.
gulp test
This runs the tests once
gulp test:watch
This runs the in continuous live-reload mode (just like gulp watch).
gulp pagespeed
Checks your site automatically against Google's Pagepeed.
MPLv2
FAQs
Yeoman generator for a full stack, testable, web app development workflow with Browserify, Jade, Stylus/SASS/LESS, Gulp and Bower
We found that generator-ayen demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.