
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
A mutex for coordinating activities across browser tabs, implemented using IndexedDB.
This library requires a browser that supports IndexedDB and either native Promise support or a polyfill.
JavaScript does not have threads, but instances of an application in different browser tabs can still perform actions concurrently. In some cases, you may want to prevent multiple tabs from performing an action at the same time.
This library provides a mutex backed by the transactional guarantees of the IndexedDB API.
npm install idb-mutex
import Mutex from 'idb-mutex'
// Create a mutex, specifying the name of the lock.
//
// Only one tab will be able to lock a mutex with a given name at any time.
const mu = new Mutex('mylock');
mu.lock().then(() => {
// This code will only be executed by one browser tab at a time.
// ...
// Release the lock when done.
return mu.unlock();
}).catch(err => {
// Handle failure to acquire lock.
console.error(err);
});
See the type definitions for full details of the API of the module.
Using arguments to the Mutex constructor, you can customize:
Which IndexedDB database and object store within that database is used. By default a database named 'idb-mutex' with a single object store named 'mutexes' is created automatically.
The time before locks acquired with lock() automatically expire. Automatic
expiration prevents frozen or closed browser tabs from holding locks
indefinitely.
How long Mutex#lock waits between attempts to lock if the lock is
contended.
There are a number of other libraries that provide similar locks. However, they generally use Local Storage.
In modern multi-process browsers such as Chrome writes to local storage have implementation-defined behavior with respect to when they become visible to other processes (ie. browser tabs). IndexedDB on the other hand provides clearer transactional semantics which can be used to implement an atomic compare-and-exchange operation that forms the basis of a mutex.
FAQs
Mutex for cross-tab coordination. Implemented using IndexedDB.
We found that idb-mutex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.