
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Hello Joe is built on top of Node's cluster module to manage worker
processes. It allows you to write your application in a vaguely Erlang
like style, where if something goes wrong, crashing the whole process
is the acceptable and preferred way of handling it.
Call hellojoe.serve with a configuration object (can be null, the
defaults are OK) and a function containing your main application code.
It should be the first and only thing your application does. Do not
initialise any resources before calling this function. The worker
processes will run your function, and anything outside of it gets run
by both worker processes and the master process. You don't want the
master process to do any work other than starting worker processes.
Thanks to the cluster module, any network sockets your subprocesses
initialise will be shared between them.
var hellojoe = require("hellojoe");
hellojoe.serve({}, function app() {
/// my application code goes here
});
Hello Joe will launch a number of subprocesses running the provided function, and the master process will be left in charge of monitoring them and restarting them as necessary.
The configuration object you provide is merged with these default values:
{
// n == the physical number of cores on the running machine
cores: n,
// minimum lifetime (ms) of a process not considered a failure
failureThreshold: 5000,
// amount of consecutive failures before retryDelay is triggered
retryThreshold: 23,
// delay (ms) before spawning processes after consecutive failures
retryDelay: 10000,
// optional filename to execute as worker process, replacing the function
worker: null,
// if worker is specified, command line arguments can be provided
workerArgs: []
}
Please note that if you specify a worker script, it will be executed
using the child_process module, not the cluster module, meaning
that sockets won't be automatically shared between worker processes.
Copyright 2014 Future Ad Labs Ltd
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0.
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
FAQs
Robust automated worker processes in the spirit of Erlang
We found that hellojoe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.