
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Data structures and utilities to represent the game of Go.
This library depends on Immutable.js and lodash.
Install godash via npm.
npm install godash
require and use it in your modules.
var godash = require('godash');
var board = godash.Board(19);
var tengen = godash.Coordinate(9, 9); // 0-based
board.moves.has(tengen); // false
var standardOpening = placeStone(
board,
tengen,
godash.BLACK
);
standardOpening.moves.has(tengen); // true
Godash provides the "primitives" for Go necessary for creating UIs that go beyond a simple SGF player. You can create whatever UI you want without having to reinvent the wheel every time.
Check out the documentation to see what Godash provides.
immutable@4, Board and Coordinate are no longer
subclasses of Seq.Board constructor changed to take Move.immutable@5 with no breaking changes to the Godash API.FAQs
Data structures and utilities to represent the game of Go
The npm package godash receives a total of 103 weekly downloads. As such, godash popularity was classified as not popular.
We found that godash demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.