
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
This module makes it easy to process and respond to JSON-RPC (v1.0) messages.
JSON-RPC is an extremely simple format to communicate between the client (for example browser) and the host (server). It's an easy way to run functions server side by providing the server the function name that needs to be executed and the params alongside with it. Server runs this function and returns the results for it.
Illustrating pseudocode
--> RUN FUNCTION "add_comment" WITH "user", "this is cool!"
<-- RETURN add_comment("user", "this is cool")
You can find the full JSON-RPC specification here.
You can install this package through npm
npm install jsonrpc
After this you can require the RPCHandler with
var rpc = require("jsonrpc").RPCHandler;
Main handler for the RPC request is jsonrpc.RPCHandler - this is a constructor function that handles the RPC request all the way to the final output. You don't have to call response.end() for example, this is done by the handler object.
var RPCHandler = require("jsonrpc").RPCHandler;
new RPCHandler(request, response, RPCMethods, debug=false);
RPChandler construtor takes the following parameters
Example script
Server accepts method calls for "check" - this method checks if the two used parameters are equal or not.
var http = require("http"),
RPCHandler = require("jsonrpc").RPCHandler;
// start server
http.createServer(function (request, response) {
if(request.method == "POST"){
// if POST request, handle RPC
new RPCHandler(request, response, RPCMethods, true);
}else{
// if GET request response with greeting
response.end("Hello world!");
}
}).listen(80);
// Available RPC methods
RPCMethods = {
// NB! private method names are preceeded with an underscore
check: function(rpc, param1, param2){
if(param1!=param2)
rpc.error("Params doesn't match!");
else
rpc.response("Params are OK!");
},
_private: function(){
// this method can't be accessed from the public interface
}
}
To send a RPC call to the server, the message needs to be sent as the request body. This can't be done with forms (as form data is urlencoded etc.) but can be done with AJAX calls.
{
"method": "method name to run",
"params": ["array", "of", "params"],
"id": "id value (optional)"
}
If id value is not set, then server takes this as a notification and return nothing (output is empty).
Parameter values are given to the RPC method as regular variables in the same order they are set in the array:
"params": ["val1", "val2", "val3"]
Will be used as
method = function(rpc, param1, param2, param3){
console.log(param1); //val1
console.log(param2); //val2
console.log(param3); //val3
}
The first parameter passed to the method is the RPCHandler object. It has two public methods - response and error.
rpc.response("This is the normal response output");
rpc.error("This is the output in case of error");
After you send the response (be it either response or error the http.ServerResponse connection is closed so you can't do much after it.
{
"result": "some kind of output, or null id error occured",
"error" : "null or an error message",
"id" : "the same id value that was used wit the request"
}
result can be any type (string, number, boolean, object, array).
For example if we need to run a RPC method named "check" with params "value" and "other" then we can do it like this (using Prototype library):
new Ajax.Request("/path/to/rpc",{
method: "post",
postBody: Object.toJSON(
{
method: "check",
params: ["value","other"],
id: 1
}),
onComplete: function(response){
var r = response.responseText.evalJSON();
if(r.error)
alert("ERROR: "+r.error);
else
alert("OK: "+r.result);
}
});
--> {method:"check", params: ["value", "other"], id: 1}
<-- {result:null, error:"Params doesn't match!", id: 1}
--> {method:"check", params: ["value", "value"], id: 2}
<-- {result:"Params are OK!", error:null, id: 2}
FAQs
Unknown package
We found that jsonrpc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.