
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
[!WARNING]
JUSTC language is currently in development and is experimental!
Documentation is coming after release of new Just an Ultimate Site Tool update. Currently, you can use experimental JUSTC demo website.

JUSTC (Just an Ultimate Site Tool Configuration language) is a powerful, small, safe, human-optimized, easy-to-use object notation (or configuration) language designed to replace JSON (JavaScript Object Notation) and also designed to be backwards compatible with JSON, with embeddable JavaScript and Luau.
npm i -g justc
CLI:
justc --help
[!NOTE] You can remove
-gflag if you don't want to install JUSTC globally.npm i justcCLI:
npx justc --help
JavaScript (Node.js):
const JUSTC = require("justc");
// example:
JUSTC.execute(`
foo = "Hello ",
bar = "World!",
baz = value(foo)..value(bar),
output specified,
return [baz] as ['output'].
`).then(result => console.log(result));
JavaScript (Browsers):
await JUSTC.initialize()
// example
const result = JUSTC.execute(`
foo = "Hello ",
bar = "World!",
baz = value(foo)..value(bar),
output specified,
return [baz] as ['output'].
`);
console.log(result);
JUSTC uses C++ as its implementation language. The entire project requires C++17. It should build (and compile to WebAssembly) without issues on Linux Ubuntu.1
JUSTC depends on:
[!NOTE] JUSTC WebAssembly module does not depend on QuickJS and/or QuickJS CMake. Instead, it uses JavaScript
evalfunction.
JUSTC implementation is distributed under the terms of MIT License.
When JUSTC is integrated into external projects, we ask that you honor the license agreement and include JUSTC attribution into the user-facing product documentation. Attribution making use of the JUSTC logo is also encouraged when reasonable.
DOWNLOADING THE SOURCE CODE AND BUILDING IT ON YOUR MACHINE IS NOT RECOMMENDED AND IS AT YOUR OWN RISK. Instead, install the compiled JUSTC WebAssembly module as an NPM package. ↩
Luau is licensed under the MIT License: https://github.com/luau-lang/luau/blob/master/LICENSE.txt ↩
JSON by Niels Lohmann is licensed under the MIT License: https://github.com/nlohmann/json/blob/develop/LICENSE.MIT ↩
CPR is licensed under the MIT License: https://github.com/libcpr/cpr/blob/master/LICENSE ↩
QuickJS CMake is licensed under the MIT License: https://github.com/RobLoach/quickjs-cmake/blob/master/LICENSE ↩
QuickJS is licensed under the MIT License: https://github.com/bellard/quickjs/blob/master/LICENSE ↩
FAQs
Just an Ultimate Site Tool Configuration language
We found that justc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.