
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

EventSource wrapper.
The EventSource API is easy as it is. Reason I created this was to hide all logic used when I implement EventSource.
IMPORTANT. This is NOT EventSource Polyfill!
It's available on npm.
npm install --save instantly
It's an UMD module. If you don't know what UMD is: https://github.com/umdjs/umd
The UMD build is also available on unpkg:
<script src="//unpkg.com/instantly/dist/instantly.umd.js"></script>
// Example
var es = new Instantly("http://your-sse-endpoint.codes/channel", {
origin: "http://your-sse-endpoint.codes", // Optional. Just an extra level of precaution to verify your event origin matches your app's origin.
retries: 2, // Optional. Default: 5 retries if connection to your endpoint fails.
timeout: 1000, // Optional. Default: 15 seconds (15000). This is how often we should retry.
closeConnNotFocus: true, // Optional. Default: false. This will close the SSE connection if the tab/window is not in focus. Will reconnect when in focus.
error: function(err) {
console.log(err);
}, // Optional. Extending the internal error handler.
open: function(event) {
console.log(event);
}, // Optional. Extend when you open a connection to SSE.
close: function() {
console.log("closed");
}, // Optional. Extend when a connection to SSE is closed. (Usually when an error occur)
injectEventSourceNode: require("eventsource") // Optional. If the module is being used in Node you're able to inject [eventsource-node](https://www.npmjs.com/package/eventsource)
});
// If you want to use default options
// var es = new Instantly('http://your-sse-endpoint.codes/channel');
// Listen to messages without any event set
es.on("message", function newMessage(msg) {
console.log(msg.data);
});
// Listen to messages with an event set
es.on("eventName", function newMessage(msg) {
console.log(msg.data);
});
// Start to listen for events send by SSE
es.listen();
If you need to close the connection client side
// Close
es.close();
// Need to open the connection again?
es.listen();
Navigate to example folder
npm install
npm start
Open your browser in http://localhost:1337
SSEHub (Server-Sent Events streaming server)
Contributions are appreciated.
MIT-licensed. See LICENSE.
FAQs
Convenience wrapper for EventSource
We found that instantly demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.