
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A DSL for defining grammars for generating strings.
npm install genitive
Call the default export with a grammar that defines productions as nonterminals mapped to an (array of) expansion.
const genitive = require('genitive')
const g = genitive({
greeting: ['Hello, <who>!', 'Hi, <who>!'],
who: 'World'
})
console.log([...g('<greeting>')])
// [ 'Hello, World!', 'Hi, World!' ]
The following examples are in YAML, and always the first production is evaluated.
You can build filters from variables, whose effect is only active within the block given to them - every assignment of a variable is undone at backtracking.
greeting:
style=formal: Good morning <title>!
style=informal:
- Hi <title>!
- Hey <title>!
title:
style=formal: [Sir, Madam]
style=informal: Dude
Good morning Sir!
Good morning Madam!
Hi Dude!
Hey Dude!
There are different kinds of filters:
var=value if unset, sets it. if set, succeeds if has the same value (using ==)var:=value sets the value regardless of whether it is set, always succeedsvar?=value sets the value if unset, always succeedsvar!=value succeeds if unset or set to a different valuevar<valuevar<=valuevar>valuevar>=value error if unset, succeeds if the mathematical relation holdsYou can specify a disjunction of filters with |:
greeting:
style=formal|style=informal: Hello, <title>!
You can also specify filters in the substitution placeholders:
greeting:
- Good morning, <style=formal:title>!
- Hi, <style=informal:title>!
- Hey, <style=informal:title>!
title:
style=formal: [Sir, Madam]
style=informal: Dude
FAQs
A DSL for defining grammars for generating strings.
The npm package genitive receives a total of 0 weekly downloads. As such, genitive popularity was classified as not popular.
We found that genitive demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.