
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
🐕-themed employee 🕑-tracking bot for Slack
Ibizan is a Slack bot built on the Botkit framework, originally contracted by Fangamer. Ibizan is designed to provide an intuitive and interactive interface to managing a timesheet.
This version of Ibizan is ready to be deployed to your Heroku with a little bit of setup. Future versions will be served as a Slack app, so consider the amount of control you want with this bot when using this method.
You must set up your configuration before running Ibizan or else it will not start.
In its current form, Ibizan punch functionality is tightly coupled to the layout of the spreadsheet it pulls from.
Click the button above to automatically deploy an Ibizan to Heroku. Make note of the app name and FQDN, because you'll need them in the next section.
After deploying to Heroku, you'll need to set the following environment variables:
IBIZAN_PORT = <port to run the server from>
IBIZAN_STORAGE_URI = <url to a firebase instance for database>
IBIZAN_SLACK_CLIENT_ID = <slack app client id>
IBIZAN_SLACK_CLIENT_SECRET = <slack app client secret key>
IBIZAN_SLACK_VERIFICATION_TOKEN = <slack app verificiation token>
IBIZAN_GOOGLE_CREDENTIALS = <file path to your Google Service Auth JSON>
If Ibizan doesn't automatically start after you finish setting all the environment variables, use the Heroku Toolbelt to run heroku restart --app={YOUR APP NAME} in the terminal.
FAQs
Dog-themed Employee Time Tracking Slack Bot
The npm package ibizan receives a total of 9 weekly downloads. As such, ibizan popularity was classified as not popular.
We found that ibizan demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.