
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
jr2 is an extremely lightweight JSON-RPC 2.0 compliant client and server for Javascript.
It is transport-independent, runs in client and server environments, has no dependencies.
It is tiny (< 2kB).
npm install --save jr2
You can use jr2 with module bundlers.
The jr2 npm package also includes precompiled production and development UMD builds in the dist folder. They can be used without a bundler.
The UMD builds make jr2 available as window.jr2 global variable.
jr2 works in any modern browser and Node.js.
import { Client } from 'jr2'
const client = new Client()
const request = client.request('sum', [23, 42], 1)
console.log(request) // { jsonrpc: '2.0', method: 'sum', params: [23, 42], id: 1 }
import { Server } from 'jr2'
const delegate = {
sum(params, { responseWithResult }, callback) {
const result = params.reduce((a, b) => a + b, 0)
callback(null, responseWithResult(result))
},
}
const server = new Server(delegate)
const request = {
jsonrpc: '2.0',
method: 'sum',
params: [23, 42],
id: 1,
}
server.handle(request, (err, response) => {
console.log(response) // { jsonrpc: '2.0', result: -19, id: 1 }
})
The delegate implements server methods as functions. Functions are invoked with
(params, context, callback) and this is bound to the delegate.
The params argument can be an array of positional parameters or an object for named parameters.
The context argument is an object implementing two helper functions: responseWithResult(result) and responseWithError(code, message, data). These helper functions help you create a compliant response and automatically match the id of the response with the id of the related request.
The callback argument is a function. It is expected to be invoked with (err, response).
MIT
FAQs
An extremely lightweight JSON-RPC 2.0 compliant client and server for Javascript
We found that jr2 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.