
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A lightweight, pragmatic syntax highlighter that's good enough™.
Hacklight is a simple tokenizer/syntax highlighter that aims to correctly parse ~95% of real-world code in the 8 most popular languages. It's designed to be:
This is not a perfect parser. It will get some things wrong, especially:
If you need 100% accuracy, use a proper AST parser. If you need something that works well for 95% of code you'll encounter and fits in a single file, this might be for you.
const { tokenize } = createTokenizer('auto'); // auto-detects HTML or JS
const tokens = tokenize(sourceCode);
// Convert to HTML with syntax highlighting
const html = tokensToHtml(tokens);
keyword - Language keywords (if, for, class, etc.)identifier - Variables, function names, etc.string - String literalsnumber - Numeric literalscomment - Commentsoperator - Operators (+, -, =, etc.)punctuation - Brackets, semicolons, etc.regex - Regular expressions (JS)html_tag - HTML tagsattr_name / attr_bool - HTML attributescss_selector - CSS selectorscss_variable - CSS custom propertiescss_at - CSS at-rules (@media, etc.)error_string - Unterminated stringswhitespace / newline - FormattingPerfect is the enemy of good. This tokenizer makes practical trade-offs:
MIT
This is intentionally kept simple. Bug fixes welcome, but feature additions that add complexity will likely be declined. The goal is to stay small and "good enough".
FAQs
A lightweight, pragmatic syntax highlighter that's good enough™
We found that hacklight demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.