
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Webhook api complete with integrated receiver server, notification trigger and file system observer
This module allows you to easily implement a webhook service to monitor changes of state. They rely on the pre-configuration of triggers that when triggered send notifications and share data in real time. This module also has a built-in server for implementing a webhook receiving API.
Install module in your project
npm i --save khosmo
Start module:
const khosmo = require("khosmo");
Create webhook events pointing to one http data receptor:
// hook one
khosmo.create("hook_post",
"http://localhost:8000/hook_posts"
);
// hook two
khosmo.create("error",
"http://localhost:8000/error/log"
);
To trigger a hook call it by passing the data you want to send:
khosmo.send("hook_post", {
name : "Pedro José",
msg : "Hello hook"
});
You can also notify with a simple text, example:
khosmo.send("hook_post", "This is one message");
Send notification with custom headers using JSON object:
khosmo.send( [webhook_name], [data], [headers])
khosmo.send("hook_post", "This is message data", {
"Content-Type": "application/json",
"Authorization": "Bearer token_here",
});
Khosmo has an integrated server that can serve as a webhook. This way you can create services to receive data sent from any webhook sender.
Build one basic Khosmo receiver:
const khosmo = require("khosmo");
// Configure
khosmo.config({
parser : true,
route : "/"
});
// Defines a global service for receiving messages
khosmo.all(message => {
console.log(`Message captured: ${JSON.stringify(message)}`);
});
Start the server with:
khosmo.listen(8000, (err)=> {
if(err) throw new Error(`Not started server: ${err.message}`);
// Server started
});
The webhook receiver is started and all messages sent to http: // localhost:8000 will be captured in khosmo.all().
The default service settings are set to:
khosmo.config(). Check all the settings in the options session
Set data filters for the message receiver. All data sent in JSON will be filtered through a specific, preconfigured key contained in the first level of the object, example:
// Configure the JSON key to perform the action filter
// "action_type" is filter custom key
khosmo.config({
action : "action_type",
parser : true,
route : "/"
});
// Create one filter to action
khosmo.filter("payment_finish", (message) => {
console.log(`Payment made by: ${message.user_name}`);
});
{
"action_type": "payment_finish",
"id": "5ASDFe5w6454asdf64fsa",
"user_name": "Richard Peterson",
"value": "US$ 486,25"
}
You can create a customized http api through the system of routes integrated in the Khosmo, example:
khosmo.route("/receiver/posts", message => {
console.log(`Message received: ${message}`);
});
//-
khosmo.route("/receiver/report", message => {
console.log(`Report notification: ${message}`);
});
Define a file monitor to identify and intercept actions that occur in a particular directory, for example:
khosmo.observe("./my_files", (fileName, action) => {
console.log(`${action} : ${name}`); // > change : file.yml
}, {
get_data: false
});
Check params:
observe( [path], [callback], [options] )
Now run a hook trigger and notify a service whenever there are changes in states to any file.
// create one hook trigger
khosmo.create("file_changed",
"http://localhost:8000/monitoring/files"
);
// create one file observer definindo ./my_files como diretório de monitoramento
khosmo.observe("./my_files", (fileName, action, data) => {
// triggering notification via webhook
khosmo.send("file_changed", {
action: action,
fileName: fileName,
fileData: data
});
}, {
get_data: true
});
All options configure of Khosmo.
{
"action": "action_check_key",
"parser": true,
"route": "/",
"debug": false
}
| key | Specifications |
|---|---|
| action | String with action key to filter on receiver |
| parser | Boolean to convert body request to json (true is default) |
| route | Default route the receiver api |
| debug | Boolean define if debug mod is active |
The MIT License (MIT)
FAQs
Webhook api complete with integrated receiver server, notification trigger and file system observer
We found that khosmo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.