
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Kokoro is a super light-weighted, headless javascript music player, which provides observable states and programmatic control apis, based on redux.
Visit it here.
const script = document.createElement('script')
script.src = '/dist/kokoro.min.js'
script.onload = () => {
window.player = new Kokoro()
console.log(`Initialized player instance of kokoro v${window.player.version}.`)
}
document.body.appendChild(script)
Q: Why do I need kokoro?
Those most popular web music players (e.g. APlayer, bPlayer) have their states binding to document elements, which means that when the UI re-renders (probably caused by a router navigation), the player completely loses its state, making the playing songs abort and requires a re-initialization of the player.
This pain is not necessary! Your users won't suffer from the abortion of their loving music while navigating to next article any more. With the use of kokoro, you player's state will be always consistent, no matter how many UI components, by what library, when and where are those components rendered.
Q: But how could I use without a UI?
We also provide a "headful" version bundled with kokoro, check it out here.
Note that it's not necessary to use kokoro with kokoro-player, you can use whatever UI you want, or you can just simply use kokoro in a programmatic way.
Q: I don't like those existing UIs, can I make my own UI?
Sure. Check out kokoro's API documentation, you'll find it super easy. If you're familiar with redux, it'll be more than easy.
You're welcomed to share your UI, your link can be added to this README. Feel free to file an issue or make a pull request.
FAQs
Headless music player written with redux.
We found that kokoro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.